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1.  SPACE  STUDY  GOALS 


Air  Force  Research  Laboratory  (AFRL)  has  initiated  an  unprecedented  change  in 
research  direction  toward  realizing  the  space  elements  of  the  Air  Force  aerospace  mission  (Co¬ 
vault,  1999).  Although  space  related  research  has  long  been  a  part  of  the  overall  research  pro¬ 
gram,  it  has  been  a  relatively  small  part.  This  redirection  is  a  dramatic  change  from  the  aircraft 
related  research,  which  has  dominated  the  lab’s  budget,  publications,  and  the  accumulated  ex¬ 
pertise  since  the  lab’s  inception. 

The  Human  Effectiveness  Directorate  (HE)  shares  both  aircraft  heritage  and  a 
significant  history  of  space  related  research.  Historic  aeromedical  predecessors  of  the  dh^ectorate 
were  involved  with  the  Mercury  and  Gemini  NASA  programs,  inventing  some  of  the  equipment 
and  methods  flown  (Dempsey,  1985).  More  recently,  a  telescope  for  direct  earth  observation 
research  (Merkel,  Task,  \^tely,  LaPuma,  Pinkus,  and  Block;  1990)  was  developed  and  flown 
on  the  Space  Shuttle. 

Although  the  new  Air  Force  space  initiative  does  not  preclude  manned  space- 
flight,  it  is  clear  that  for  the  foreseeable  future  most  Air  Force  space  operations  will  be  of  an  un¬ 
manned  variety.  This  has  led  to  questioning  what  role  the  HE  will  have  on  AFRL’s  new  space 
focus  when  unmanned  spacecraft  will  be  predominate.  The  purpose  of  this  study  is  to  examine 
carefully  the  40  year  history  of  unmanned  spaceflight  to  determine  whether  there  is  a  role  for 
human  factors  and  ergonomic  engineering  in  such  space  operations  and  what  exactly  that  role 
might  be.  This  will  be  accomplished  in  a  systematic  four-step  process. 

1.1.  Ascertaining  the  State-of-the-Art  In  Satellite  Control 

Satellites  are  controlled  by  some  combination  of  on-board  automation  and  human 
ground  controllers.  The  first  task  is  to  describe  how  this  is  accomplished  in  contemporary  Air 
Force,  other  Government,  and  commercial  settings.  This  examination  will  seek  to  determine 
how  satellite  displays  and  controls  are  designed  and  implemented  and  identify  specific  elements 
needing  attention.  Satellite  controlling  is  a  part  of  the  larger  human-computer  interface  (HCI) 
problem,  but  space  has  unique  aspects,  which  make  it  different  from  other  HCI  problems. 

1 .2.  Estimating  the  Impact  of  Human  Error  on  Satellite  Operations 

Over  the  40  years  of  unmanned  spaceflight,  there  have  been  many  cases  of  vehi¬ 
cle  loss.  Some  of  those  losses,  including  recent  ones,  can  be  directly  attributable  to  human  error. 
Although  human  error  can  never  be  completely  eliminated,  it  can  be  minimized  by  attention  to 
the  human  role  in  space  vehicle  operations.  Human  factors  engineering  has  made  significant 
contributions  to  reducing  aircraft  losses  and  there  is  every  reason  to  believe  similar  safety  im¬ 
provements  can  be  made  in  satellite  operations. 
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1 .3.  Review  Existing  Research  in  Satellite  Control 

Any  research  program  planning  requires  a  thorough  understanding  of  existing 
publications  to  serve  as  a  basis  for  the  plan  and  to  avoid  unplanned  replications.  Even  if  the  ex¬ 
isting  literature  is  limited  in  scope,  that  certainly  is  critical  information  toward  justifying  initiat¬ 
ing  new  research.  This  step  will  include  a  forward  look  toward  anticipated  demands  on  satellite 
operators. 

1 .4.  Proposed  Human  Engineering  Research  and  Development  Program 

Once  the  preceding  goals  are  accomplished,  the  last  step  is  to  recommend  a  spe¬ 
cific  research  program  which  will  make  important  contributions  to  Air  Force  Space  operations, 
compliment  AFRL  initiatives,  assist  other  Government  and  commercial  space  ventures,  and 
make  a  significant  contribution  to  the  scientific  and  engineering  literature. 
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2.  ASCERTAINING  THE  STATE-OF-THE-ART  IN  SATELLITE  CONTROL 

2.1.  Current  Satellite  Operations  Centers 


2.1.1.  Government 

National  Aeronautic  and  Space  Administration  (NASA)  is  arguably  the  premiere 
agency  for  space  operations  in  the  world.  It  directly  controls  or  allocates  control  to  subsidiary 
organizations  of  all  civilian  Government  space  vehicles. 

Much,  but  not  aU,  of  NASA’s  ground  controller  software  is  hosted  within  win¬ 
dows  and  graphical  user  interface  (GUI).  Some  functions  are  still  performed  by  text-based  soft¬ 
ware,  as  discussed  later  in  the  Mars  Climate  Orbiter  Failure  Report.  The  Space  Shuttle  launch 
control  facilities  recently  transitioned  into  a  new  facility  after  operating  for  a  decade  in  the  60’ s 
Saturn/ Apollo  control  room.  NASA  maintains  a  consolidated  planetary  exploration  control  cen¬ 
ter,  control  centers  at  JPL,  Johns  Hopkins  University,  and  other  locations. 

Human  factors  for  ground  controls  displays  are  done  at  Goddard  Space  Flight 
Center  (GSFC),  Maryland.  There,  supported  by  the  Pacific  Northwest  National  Laboratory,  the 
Information  Systems  Center  (ISC)  is  pursuing  improvements  in  ground  controllers  displays  and 
controls.  Fox,  Breed,  Moe,  Pfister,  Traszkowski,  Uehling,  Donkers,  and  Murphy  (1999)  de¬ 
scribe  display  and  control  design  using  the  user-centered  design  methods.  Their  approach  in¬ 
cludes  cognitive  modeling,  rapid  display  prototyping,  software  prototyping,  and  usability  testing. 
Fox  cites  a  number  of  example  applications  where  user-centered  design  has  been  applied  in¬ 
cluding  the  Hubble  telescope  and  Earth  Observing  System.  GSFC/ISC  is  also  conducting  re¬ 
search  in  intelligent  agents  as  aids  to  ground  controllers  (Truszkowski,  Murphy,  and  Norman, 
1999).  Truszkowski  et.  al.  examines  anomaly  processing  which  exceeds  the  capability  of  on¬ 
board  automation.  At  issue  is  how  fast  can  operators  be  updated  on  system  status  and  aid  in  the 
solution  of  the  anomaly.  An  earlier  paper  by  Hartley  and  Hughes  (1996)  summarized  earlier 
efforts  to  automate  both  on-board  and  ground-based  operations.  Clearly,  any  AFRL  space  re¬ 
search  program  would  benefit  from  cooperation  or  collaboration  with  GSFC. 

2.1.2.  Military 

Military  satellite  operations  are  conducted  under  the  auspices  of  United  States 
Space  Command  (USSC)  and  its  separate  Army,  Navy,  and  Air  Force  Space  components.  Key 
players  in  AFSPC  (AFSPC,  Peterson  AFB,  CO)  are  its  operational  units,  which  actually  operate 
the  space  assets.  AFSPC’s  50*  Space  Wing  is  the  largest  Air  Force  satellite  operator,  controlling 
over  50  satellites  through  its  ten  Space  Operations  Centers  (SOCs)  and  employing  1300  space 
system  operators. 

The  state-of-the-art  in  military  satellite  control  is  heavily  dependent  on  1970’s 
technology  first  introduced  back  with  the  first  military  space  systems.  Support  computers  are  old 
and  difficult  to  maintain  mainframe  technology  running  special  purpose  hardware  and  software. 
These  legacy  systems  are  expensive  to  maintain  and  even  more  expensive  to  modify,  since 
nearly  all  contracting  must  be  done  sole-source  to  the  original  developers. 
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Each  satellite  control  system  is  different.  The  systems  were  developed  independ¬ 
ently  over  three  decades.  The  satellites  are  radically  different  in  the  missions,  payloads,  and  sub¬ 
systems.  The  user  displays  for  these  systems  can  be  characterized  as  all  text-based,  displaying  in 
some  cases  scrolling  raw  download  data  from  the  satellites.  This  interface  puts  a  significant  bur¬ 
den  on  the  satellite  system  operators,  requiring  them  to  interpret  and  analyze  disparate  informa¬ 
tion  without  much  machine  assistance.  Commands  are  issued  via  a  command  line  interface 
(CLI)  with  checking  manually  performed  by  a  second  operator  to  ensure  command  accuracy. 

The  50*  Space  Wing’s  Operations  Group  manages  operator  training.  Training 
satellite  operators  is  primarily  done  using  paper  course  materials  and  console  mock-ups.  The 
Operations  Group  has  a  Satellite  Operations  Simulator  Section,  which  develops  and  manages 
satellite  operations  simulators.  However,  there  is  a  heavy  reliance  of  on-the-job-training  (OJT). 

Technology  development  and  insertion  into  space  operations  is  done  through  sev¬ 
eral  organizations.  AFSPC  operates  the  Space  Warfare  Center  (SWC),  Schriever  AFB,  CO, 
which  is  tasked  with  advancing  space  tactics  development,  testing,  analysis,  and  training  pro¬ 
grams.  SWC  operates  the  Space  Battle  Lab  (Schriever  AFB,  CO)  which  identifies  innovative 
space  operations  and  logistics  concepts  and  measures  their  effectiveness.  Air  Force  Materiel 
Command  (AFMC)  supports  acquisition  and  logistics  for  space  through  its  Space  and  Missile 
Systems  Center  (SMC)  (Los  Angles  AFB,  CA).  SMC  operates  the  Center  for  Research  Support 
(CERES,  Schriever  AFB,  CO)  to  discover  and  test  commercial  off-the-shelf  (COTS)  technolo¬ 
gies  to  support  AFSPC.  CERES  is  particularly  active,  having  established  laboratory  test  facili¬ 
ties  and  conducting  evaluation  of  several  COTS  systems  for  possible  use  by  AFSPC. 

SMC  participated  in  a  Human-Machine  Interface  Working  Group  (HMIWG)  with 
support  contractor  Lockheed  Martin  and  Aerospace  Corporation.  A  compact  disk  of  example 
formats  was  obtained  and  can  be  characterized  as  translation  of  the  text-based  displays  into  con¬ 
temporary  windows  and  GUI  format.  The  first  two  formats  are  examples  of  the  HMIWG  pro¬ 
posed  displays  employing  text  representations  with  buttons  and  pull-down  menus  (Figures  2.1.2- 
la  and  b).  The  second  two  formats  (Figure  2.1.2-2a  and  b)  introduce  graphical  representations. 
Figure  2.1.2-2a  shows  a  block  diagram  of  systems  and  their  status.  Figure  2.1.2-2b  shows  the 
positional  drift  of  a  satellite  relative  to  its  assigned  location,  although  employing  the  satellite  im¬ 
age  in  this  case  seems  of  little  value.  These  HMIWG  formats  represent  a  significant  step  for¬ 
ward  in  display  design.  However,  display  formats  employing  such  research  concepts  like  cogni¬ 
tive  engineering  and  intelligent  aiding  can  perform  even  better  than  these  displays  based  on  the 
contemporary  desktop  paradigm. 
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a.  b. 


Figure  2.1.2rl.  HMIWG  formats  which  place  text  information  in  the  Windows  and  GUI  format  paradigm. 

Notice  the  use  of  buttons  and  pull-down  menus. 


a.  b. 


Figure  2.1.2-2.  Graphical  representations  of  information  including  block  diagram  (a)  and  an  X-Y  plot  (b). 

The  problems  associated  with  satellite  ground  station  displays  and  controls  are 
understood,  but  the  operational  community  has  been  slow  to  respond.  Modifying  legacy  systems 
is  expensive  and  disruptive  of  operations.  The  operations  community  solution  is  to  increase 
staffing  of  controller  crews  to  compensate  for  their  displays  and  control  problems  with  more 
crewmembers.  This  near-term,  problem-solving  strategy  is  both  shortsighted  and  expensive. 
The  long  life  cycle  of  space  systems  means  that  manpower  costs  will  be  prohibitive.  Addition¬ 
ally,  the  labor-intensive  solution  may  actually  increase  the  chances  of  operators  making  a  signifi¬ 
cant  error  in  satellite  operations. 

2.1.3.  Commercial 

There  are  COTS  hardware  and  software  systems  for  satellite  control.  Lockheed 
Martin  offers  its  Space  Control  System-21™  (SCS-21™).  SCS-21™  is  based  on  commonly- 
used  hardware  platforms  (workstations),  uses  Ethernet  communications,  a  GUI  interface,  and 
talks  to  a  variety  of  common  third  party  hardware.  At  least  15  commercial  geosynchronous 
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communications  satellites  employ  SCS-21™  in  their  day-to-day  operations  and  the  CERES  Air 
Force  facility  at  Schriever  ATO,  CO  is  evaluating  it  for  military  applications. 

Additionally,  a  telephone  interview  was  conducted  with  the  manager  of  the 
IRIDIUM™  telephone  satellite  constellation.  The  IRIDIUM™  satellite  constellation  consists  of 
66  orbital  vehicles  located  in  low  earth  orbit  (760  km,  485  miles)  in  six  different  orbital  planes 
and  in  number  of  vehicles  and  is  probably  the  most  complex  satellite  system  in  existence.  The 
IRIDIUM™  control  center  employs  a  proprietary  software  system  based  on  GUI  interface  in 
control  of  the  constellation.  According  to  the  control  center  manager,  the  control  software  was 
contracted  out  and  was  unsatisfactory  as  delivered.  They  have  evolved  a  spiral  development 
method  with  software  engineers  worldng  in  the  control  center  to  evolve  their  displays  and  con¬ 
trols  to  where  they  consider  the  system  effective.  Their  biggest  problem  is  maintaining  status  on 
all  the  spacecraft,  which  differ  in  block  configuration  and  in  their  current  operational  state. 

It  appears  that  conunercial  satellite  control  systems  are  approaching  and  surpass¬ 
ing  the  complexity  of  military  systems.  Close  Government  ties  to  these  commercial  operators 
while  protecting  the  proprietary  nature  of  their  systems  (the  satellite  telephone  business  is  com¬ 
petitive)  can  result  in  beneficial  exchanges  between  the  two  communities. 

2.2.  Existing  Standards  and  Guidelines 

The  only  existing  standards  and  guidelines  that  were  found  for  space-related  dis¬ 
plays  and  controls  were  published  by  NASA  (NASA-STD-3000)  and  several  publications  of 
American  Institute  of  Aeronautics  and  Astronautics  (AIAA).  NASA-STD-3000  is  similar  to 
MIL-SPEC- 1472D  as  it  favors  a  more  anthropometric  and  physical  ergonomic  view.  Volume  1, 
Section  9  covers  workstation  design  and  illumination,  switch  configuration,  labeling,  etc.,  and 
virtually  nothing  about  display  format,  symbology,  or  anything  cognitive  about  HCI  in  general  or 
satellite  control  in  particular.  Goddard  Space  Flight  Center  has  published  an  outstanding  set  of 
guidelines  for  controls  and  displays,  “User-Interface  Guidelines,”  DSTL-95-033.  This  document 
contains  guidance  for  basic  interface  components,  screen  layout  and  design,  interaction  styles, 
window  management,  visual  coding  techniques,  and  user  feedback. 

Several  of  the  AIAA  publications  also  deal  with  ergonomic  design,  but  are  quite 
specific  to  satellite-related  issues.  These  publications  include  AIAA  G-042- 1991 -AIAA  Guide 
to  Design  for  On-Orbit  Spacecraft  Servicing,  and  AIAA  G-056- 1992-Guide  for  Berth¬ 
ing/Docking/Grasping  interfaces  for  Serviceable  Spacecraft.  Proposed  Guide  G-042- 1991  is 
typical  of  these  publications  and  deals  with  design  for  on-orbit  spacecraft  servicing.  An  out¬ 
growth  of  NASA  workshops,  assembled  by  NASA  with  the  help  of  industry  to  recommend  spe¬ 
cific  configurations  to  facilitate  on-orbit  service  activities  by  astronauts  and  cosmonauts.  The 
guide  provides  several  case  study  examples  from  the  space  station,  advanced  x-ray  astrophysics 
facility,  and  other  orbital  systems  to  illustrate  its  design  strategies,  including  sample  checklists 
for  the  service  operations.  Given  the  study  focus  on  unmanned  satellite  control,  this  publication 
and  related  ones  on  manned  spaceflight  are  only  of  peripheral  interest. 

Perhaps  the  most  interesting  of  the  AIAA  publications  is  American  National 
Standards  Institute  (ANSI)/AIAA  R-023A-1995~Human-Computer  Interfaces  for  Space  System 
Operations.  Based  on  the  list  of  collaborators,  this  standard  grew  out  of  the  military  satellite 
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control  community  and  its  support  contractors  and  seems  to  be  an  effort  to  consolidate  the  ap¬ 
proach  of  Air  Force  contractors  for  what  became  the  SOC.  The  standard  does  a  fine  job  of  ad¬ 
dressing  a  common  look,  feel,  and  operation  for  satellite  control  consoles.  The  standard  goes  as 
far  as  to  recommend  a  standard  layout  based  on  a  conventional  windows  GUI.  The  windows  are 
tiled  with  cascade  instead  of  layered  so  as  not  to  hide  critical  information,  providing  sliders  to 
scroll  within  a  window  (Figure  2.2-1). 
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Figure  2.2-1.  Recommended  Window  Layout  From  ANSI/AIAA  R-023A-1995 


Also  provided  are  a  set  of  icons  for  a  variety  of  satellite  boosters,  control  tasks, 
systems,  subsystems,  ground  systems,  and  other  items.  Examples  of  some  of  these  icons  are 
seen  in  an  example  display  (Figure  2.2-2). 
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Figure  2.2-2.  Example  Display  With  Icons  From  ANSI/AIAA  R-023A-1995 

The  ANSI/AIAA  standard  defines  a  very  comprehensive  list  of  core  interface  re¬ 
quirements  (display  control,  messaging,  alerting,  error  correction)  and  some  extremely  insightful 
enhancements  (on-line  help,  messaging,  graphics,  decision  support,  computer-based  reasoning). 
The  requirements  for  these  interface  operations  are  given  along  with  useful  guidance  examples, 
however,  details  about  implementation  are  not  provided.  Without  more  specific  guidance,  dis¬ 
plays  can  satisfy  the  requirements  with  vastly  different  formats  and  controls,  leading  to  the  cur¬ 
rent  situation  of  unique  displays  for  each  satellite. 

The  lack  of  detail  recommendations  can  be  attributed  to  several  causes.  Foremost 
is  probably  the  desire  to  not  restrict  the  contractors  who  must  deliver  the  working  systems  (at 
least  seven  different  contractors  are  listed  as  participating)  and  mirrors  the  growing  trend  away 
from  uimecessary  specifications.  Another  possible  cause  is  that  each  satellite  system  is  unique, 
so  one  “specification”  may  not  fit  all  satellite  systems.  This  topic  came  up  several  times  during 
interviews  and  raises  the  interesting  issue  of  abstraction  in  satellite  control.  It  seems  as  though 
except  for  differences  in  the  payload,  a  large  number  of  satellite  operations  are  common  among 
platforms  and  differ  only  in  how  they  must  accomplish  those  common  tasks.  For  example, 
alignment  of  a  satellite  ought  to  be  the  same  for  all  satellites,  with  the  means  of  the  realignment 
(reaction  wheel,  thruster,  etc.)  transparent  to  the  operator.  System  or  subsystem  peculiarities 
ought  to  be  only  made  visible  if  remedial  action  requiring  details  of  their  implementation  is  nec¬ 
essary  to  understand  the  fault  situation.  The  consolidation  of  displays  for  directing  common  sat¬ 
ellite  operations  and  for  monitoring  common  satellite  systems  and  subsystems  while  managing 
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unique  details  of  each  satellite  mission  and  hardware  would  reduce  workload,  training,  and  allow 
controllers  to  more  easily  transition  between  different  systems.  Augmenting  the  ANSl/AIAA 
guidelines  could  be  considered  a  major  deliverable  of  a  design  and  research  program 
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3.  IMPACT  OF  HUMAN  ERROR  ON  SATELLITE  OPERATIONS 


One  of  the  most  pressing  reasons  to  do  research  to  improve  satellite  control  and 
operations  is  the  huge  cost  of  error  or  failure  associated  with  satellite  operations.  The  recent 
boost-phase  failure  of  a  Titan  inC  with  a  military  communications  satellite  was  valued  at  $1.2 
billion  (Atkinson,  1999;  Mann,  1999).  The  failure  was  eventually  attributed  to  an  inaccurate 
software  load  by  contractors.  Military  satellite  losses  inevitably  reduce  operational  effective¬ 
ness,  erode  public  relations  with  Congress,  and  can  reduce  pubhc  support  for  military  space  op¬ 
erations;  the  value  of  these  losses  is  difficult  to  measure.  Therefore,  modest  investments  to  re¬ 
duce  or  prevent  human  error  from  causing  or  contributing  to  satellite  losses  will  pay  huge  divi¬ 
dends  to  the  Air  Force. 


3.1.  Press  Reports 

Much  of  the  early  failures  in  satellite  operations  are  shrouded  in  secrecy  or  not 
very  well  documented.  The  press  has  revealed  several  instances  where  human  error  played  a  role 
in  satellite  loss.  Although  some  of  these  errors  had  insignificant  effects  on  the  mission,  even  in¬ 
nocuous  errors  can  trigger  sequences  of  events,  which  lead  to  serious  consequences.  Any  de¬ 
parture  from  nominal  operations  must  be  considered  serious  because  of  the  potential  for  cascad¬ 
ing  errors.  Such  was  the  case  of  the  NASA-ES  A  Solar  Heliospheric  Observatory  that  was  inves¬ 
tigated  in-depth  and  is  discussed  later. 

The  Russians  have  identified  human  error  in  space  missions  on  a  number  of  occa¬ 
sions.  In  1988,  a  Soviet  Soyuz  manned  capsule  commander  confessed  to  nearly  causing  a  fatal 
accident  when  he  restarted  a  breaking  rocket  during  a  failed  landing  maneuver  (L.A.  Times, 
1988).  The  Phobos  1  Mars  probe  lost  contact  because  a  spacecraft  controller  failed  to  pass  the 
last  byte  of  a  software  load  to  Phobos  I  space  probe  as  the  reason  it  lost  orientation  and  commu¬ 
nications  (Dye,  1988).  A  Russian  cosmonaut’s  error  handling  docking  of  a  Progress  supply 
rocket  with  the  Soviet/Russian  Mir  space  station  provided  the  highest  drama,  since  the  Mir  was 
damaged  and  the  crew’s  lives  put  at  risk  (Filipov  and  Chanler,  1997).  Later,  the  same  Mir  crew 
(different  cosmonaut)  inadvertently  disconnected  a  computer  causing  loss  of  attitude  control. 

The  Russians  are  not  alone  in  encountering  human  error  in  space  operations.  The 
highly  regarded  Mars  Pathfinder  mission  lost  a  full  day  of  exploration  when  a  controller  miscal¬ 
culated  a  communication  time  by  1 1  minutes,  resulting  in  transmission  of  computer  commands 
to  the  lander  when  its  receiver  was  turned  off  (Wilford,  1997).  It  took  several  hours  to  determine 
the  cause  of  Pathfinder’s  inaction— too  late  to  retransmit  the  commands  in  the  same  day. 

Even  Space  Shuttle  operations  have  been  affected  by  human  error  (Associated 
Press,  1990).  A  ground  generated  signal  caused  the  Shuttle  Columbia  to  start  a  slow  three  de¬ 
grees  per  second  spin  while  the  crew  slept.  A  glitch  of  undisclosed  origin  conunanded  the  spin 
and  the  crew  had  to  be  awaken  to  manually  eliminate  the  spin. 

An  erroneous  computer  command  sent  by  ground  controllers  caused  an  interrup¬ 
tion  in  the  Magellan  spacecraft’s  mapping  of  Venus  (Washington  Post,  1990).  It  is  uncertain 
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whether  the  command  was  sent  in  error  or  whether  it  got  corrupted  in  transmission  and  reception. 
The  spacecraft’s  signal  was  lost  for  40  minutes  during  the  incident. 

NASA  also  acknowledged  that  technicians  misaligned  on  the  rocket  the  Far  Ul¬ 
traviolet  Spectroscopic  Explorer  (FUSE)  satellite  by  5.3  degrees  prior  to  its  successful  launch  24 
June  1999  (Aviation  Week,  5  July  1999).  The  error  was  discovered  several  days  before  launch 
and  was  deemed  not  a  threat.  Boeing  technicians  made  the  error  and  NASA  reviewed  and  ap¬ 
proved  the  installation.  It  was  not  detected  until  the  spacecraft’s  own  laser  ring  gyroscope  re¬ 
ported  the  error.  Often  these  kinds  of  errors  are  attributed  to  process  mistakes  or  the  failure  to 
follow  approved  procedures. 

3.2.  Case  Studies  of  Human  Error  During  Spacecraft  Operations 

More  important  than  the  press  reports  of  satellite  losses  are  the  after-accident  in¬ 
vestigations.  Several  reports  have  been  published  about  operator  errors  resulting  in  aircraft  loss. 
These  reports  are  valuable  not  only  for  Ae  attribution  of  blame,  but  also  for  the  proposed  reme¬ 
dial  actions. 

3.2.1 .  Human  Error  in  the  Space  Systems  Engineering  Data  Base 

The  Aerospace  Corporation  maintains  the  Space  Systems  Engineering  Data  Base 
(SSED)  which  tracks  anomalies  in  spacecraft  launch  and  operations  including  NASA,  DoD,  for¬ 
eign  Government,  and  commercial  ventures.  At  the  request  of  the  AFRL,  a  search  of  the  SSED 
was  conducted  to  identify  all  human  error  induced  anomalies  since  the  1950’s  (Amheim,  1999). 
The  data  base  contains  a  total  of  9,678  anomaly  reports,  of  which  441  are  ground  station  opera¬ 
tions  with  human  factor  implications  (4.6%).  It  is  important  to  note  that  mistakes  and  errors, 
which  do  not  significantly  affect  the  mission,  are  not  reported  in  the  SSED.  Also,  the  SSED  in¬ 
cludes  reports  only  on  unclassified  launches  and  payloads.  This  means  the  SSED  reports  are  a 
conservative  estimate  of  the  size  of  the  human  error  problem— they  are  the  visible  “tip”  of  what  is 
likely  to  be  a  larger  “iceberg”  of  problems  caused  by  human  error. 

Eight  catastrophic  failures  were  attributed  to  human  error.  Six  of  these  occurred 
between  1957  and  1962— very  early  in  space  operations.  Four  of  these  six  were  attributed  to 
range  safety  officers  intervening  and  destroying  vehicles  prematurely.  The  other  two  were  mis- 
configured  launch  vehicles,  which  resulted  in  boost  phase  failures.  Interestingly,  the  remaining 
two  losses  occurred  in  the  past  two  years.  These  were  the  Solar  Heliospheric  Observatory 
(SOHO)  satellite  and  Mars  Climate  Observer  losses  (detailed  in  following  reports). 

Four  additional  satellites  suffered  significant  mission  losses  due  to  human  mis- 
cues.  One  of  these  was  a  procedural  error  while  the  other  four  were  erroneous  commands  trans¬ 
mitted  to  spacecraft.  Procedural  errors  and  incorrect  command  transmission  are  the  two  most 
common  forms  of  human  errors.  Figure  3.2.1-1  shows  how  human  error  fits  in  the  larger  picture 
of  ground  station  induced  anomalies.  All  figures  were  directly  copied  from  Amheim  (1999). 
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Figure  3.2.1-1.  Distribution  of  Operational  Anomalies  Attributed  to  the  Ground  Station  (SSED). 

Many  more  low  impact  errors  were  recorded  in  the  data  base.  These  errors  did 
not  terminate  or  degrade  the  mission,  but  resulted  in  such  consequences  as  payload  data  loss, 
high  fuel  expenditures,  and  the  like.  The  breakdown  of  these  lesser  consequences  of  human  er¬ 
ror  is  shown  in  Figure  3.2. 1-2. 


Figure  3.2. 1-2.  Impact  of  Operational  Anomalies  Due  to  Human  Error  (SSED). 
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The  types  of  human  errors  in  the  SSED  are  shown  in  Figure  3.2.1-3.  Although 
the  breakdown  is  not  very  detailed,  most  of  the  errors  are  attributable  to  procedure  execution  and 
command  errors  (37%  each).  The  remaining  26%  of  errors  were  lumped  into  the  non-descriptor 
operator  error  or  other  categories. 


Figure  3.2.1-3.  Types  of  Operational  Anomalies  Attributed  to  Human  Error  (SSED). 

Searching  the  corrective  recommendations  of  the  SSED  data,  Amheim  and  Tos- 
ney  reveal  that  most  recommendations  are  for  more  training/rehearsals,  better  procedural  disci¬ 
pline,  and  better  procedures  (Figure  3.2. 1-4).  Lesser  causes  identified  are  situation  awareness, 
loss  of  understanding  configuration,  and  high  pressure  or  information  overload. 

The  individual  incident  summary  included  with  the  report  reveals  several  inter¬ 
esting  observations.  First,  the  number  of  reports  varies  greatly  from  spacecraft  to  spacecraft. 
The  Hubble  Space  Telescope  has  sixteen  different  human  error  reports.  There  are  several  expla¬ 
nations  for  the  variance  in  numbers.  First,  some  programs  may  be  more  diligent  in  reporting 
their  human  error-related  problems.  Second,  some  spacecraft  are  more  command  intensive  than 
others  and  so  are  more  prone  to  operator  error.  Hubble  is  continuously  redirected  to  image  tar¬ 
gets  and  probably  fits  in  this  category.  A  second  trend  evident  in  the  spacecraft  with  multiple 
incident  reports  is  that  there  seems  to  be  an  increase  in  intervals  between  reports  as  the  mission 
progresses.  This  indicates  a  “learning  curve”  in  operations  and  that  ground  controllers  appear  to 
be  learning  how  to  handle  the  spacecraft  through  “OJT”  training.  This  is  a  dangerous  approach 
to  controlling  expensive  space  vehicles  that  can  be  irrecoverably  lost. 
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Figure  3.2.1-4.  Potential  Areas  for  Corrective  Action  in  the  Prevention  of  Operational  Anomalies  Caused  by 

Human  Error  (SSED). 

The  low  incidence  of  high  pressure  and  information  overload  incidents  really  re¬ 
flects  the  circumstances  of  most  satellite  control  centers.  Most  spacecraft  internal  and  orbital 
changes  are  preplanned  and  not  real-time  in  nature.  If  a  procedure  is  going  slowly  or  if  a  prob¬ 
lem  develops,  the  standard  operating  procedure  is  to  cease  activity,  reevaluate  the  situation,  and 
complete  the  activity  during  a  later  orbit.  It  would  be  interesting  to  see  whether  this  category  is 
higher  in  classified  intelligence  gathering  spacecraft  where  there  are  limited  windows  of  oppor¬ 
tunity  to  collect  information  on  ground  targets.  Real-time  control  systems,  like  a  space-based 
defense  system,  would  also  create  more  high  pressure  and  information  overload  related  incidents. 

The  report  contains  a  detailed  breakdown  of  each  incident,  its  cause,  and  its  con¬ 
sequences.  In  their  summary,  Amheim  et  al.  concludes  “human  errors  can  have  a  significant  im¬ 
pact  on  mission  life,  a  focus  on  the  human  factors  and  prevention  of  man-made  operational 
anomalies  can  improve  the  chances  of  a  successful  and  long  lived  mission.”  They  recommend 
the  most  effective  remedial  actions  are  discipline  and  technical  thoroughness.  Further,  training 
and  flight-like  rehearsals  can  enhance  the  expertise  and  experience  of  controllers  and  signifi¬ 
cantly  reduce  human  error. 

3.2.2.  Solar  Heliospheric  Observatory  Loss  and  Recovery 

Perhaps  the  most  striking  documented  case  of  operator  error  affecting  satellite 
operations  is  that  of  Solar  Heliospheric  Observatory  (SOHO),  a  joint  NASA  and  European  Space 
Agency  (ESA)  cooperative  project.  Contact  with  the  functioning  SOHO  spacecraft  was  lost  25 
June  1998  during  a  series  of  calibration,  maneuvers,  and  reconfigurations.  The  remarkable  re¬ 
covery  of  SOHO  by  cleaver  engineers  also  resulted  in  an  exact  determination  instead  of  specula¬ 
tion  for  the  loss  of  contact  (Hellemans,  1998).  The  investigation  board  report  (1999)  determined 
the  loss  “was  a  direct  result  of  operational  errors— a  failure  to  adequately  monitor  spacecraft 
status  and  an  erroneous  decision  which  disabled  part  of  the  on-board  autonomous  failure  detec¬ 
tion.”  (page  5) 
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As  in  any  accident,  multiple  causes  converged  to  produce  SOHO’s  loss-of- 
control.  The  automated  scripts  used  to  perform  routine  changes  were  not  properly  tested  and  the 
key  gyroscope  (Gyro- A,  which  is  one  of  three)  was  left  despun  when  it  should  have  been  oper¬ 
ating.  The  gyros  were  periodically  shut  down  to  increase  their  operational  Ufe.  At  the  end  of  the 
script  in  question,  a  second  (Gyro-B)  was  erroneously  left  in  a  high-gain  setting  which  produced 
telemetry  roll  rates  20  times  greater  than  were  actually  occurring.  The  “apparent”  discrepancies 
between  the  gyros  resulted  in  an  Emergency  Sun  Reacquisition  (ESR-5,  the  fifth  time  since 
launch  that  an  ESR  occurred),  a  safe  mode  allowing  recovery  of  communications  with  the  satel¬ 
lite.  Controllers  did  not  take  sufficient  time  to  analyze  the  cause  of  the  ESR-5,  ascertained  the 
Gyro-B  gain  error,  but  missed  the  fact  that  Gyro-A  was  still  despun. 

Upon  recovery  from  ESR-5,  things  continued  to  get  worse.  The  attitude  control 
system  continued  to  use  input  from  the  despun  Gyro-A  and  triggered  thruster  firings  to  counter 
its  erroneous  output.  The  resulting  thruster  induced  roll  caused  the  still  operating  Gyro-B  to 
trigger  an  ESR-6.  Controllers  then  interpreted  the  disagreement  between  the  output  of  Gyros  A 
and  B  to  be  caused  by  an  error  in  Gyro-B  and  commanded  it  to  shut  down.  The  controllers 
commanded  Initial  Sun  Acquisition  (ISA)  using  the  thrusters  under  control  of  the  attitude  control 
system,  which  was  still  responding  to  the  erroneous  ouq)ut  of  Gyro-A  and  degraded  the  ESR  safe 
mode  controller.  Again,  thruster  induced  spin  triggered  ESR-7,  another  safe  mode.  However, 
this  time,  coupled  torque  of  the  thrusters  and  lack  of  gyro  input  combined  to  overcome  the  ESR 
controller  and  spacecraft  attitude  control  was  lost  along  with  thermal  management,  solar  cell  ori¬ 
entation,  and  communications. 

The  board  listed  13  direct  and  indirect  contributing  causes  to  the  loss-of-control  of 
SOHO.  Of  those  causes,  many  can  be  considered  human  factors  related.  Those  aspects  of  hu¬ 
man  factors  implicated  are  workload,  situation  awareness,  display  design,  communication  break¬ 
down,  training,  and  decision  processes.  The  following  are  the  13  causes  with  comment  on  those 
human  factors  related. 

1 .  Failure  to  control  change. 

2.  Failure  to  perform  risk  analysis  of  a  modified  procedure  set. 

3.  Failure  to  communicate  change. 

Part  of  any  configuration  control  system  is  proper  naming  to  identify 
modifications.  The  operational  script  which  triggered  the  events  leading 
to  SOHO’s  loss  was  named  A_CONFIG_N  and  in  its  original  form,  prop¬ 
erly  managed  Gyro-A.  This  script  was  modified  later  in  the  program  and 
these  modifications  introduced  the  error  of  leaving  Gyro-A  despun.  Lack 
of  configuration  control  and  failure  to  rename  the  modified  script  resulted 
in  a  failure  to  properly  test  the  modified  script.  Communication  of  the 
change  by  renaming  the  script  would  have  resulted  in  proper  testing  of  the 
new  script. 

4.  Failure  to  properly  respect  autonomous  Safe  Mode  triggers. 
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Under  time  pressure  to  satisfy  an  aggressive  science  schedule,  controllers 
failed  to  fully  analyze  the  conditions  leading  to  the  ESRs.  An  ESR  is  de¬ 
signed  to  last  up  to  48  hours,  so  there  was  sufficient  time  to  fully  research 
and  make  decisions.  The  telemetry  frames  transmitted  with  each  ESR 
were  not  examined,  in  part  because  of  display  problems.  Decisions  were 
made  in  a  hurry  and  based  on  insufficient  information. 

5.  Failure  to  follow  the  operations  script— failure  to  evaluate  primary  and  an¬ 
cillary  data. 

The  Flight  Operations  Team  (EOT)  exhibited  poor  situation  awareness  of 
Gyro-A  despun  state.  However,  the  accident  board  review  of  telemetry 
also  discovered  that  three  of  the  four  battery  discharge  regulators  were 
disconnected  from  the  spacecraft  bus.  This  condition  existed  for  at  least 
several  months  prior  to  SOHO  loss  and  was  unknown  to  the  controllers! 
Though  the  improper  configuration  did  not  figure  into  SOHO’s  loss-of- 
control,  it  meant  that  the  duration  of  telemetry  transmission  would  be  only 
minutes  after  attitude  control  due  to  restricted  access  to  the  batteries. 

6.  Failure  to  question  telemetry  discrepancies. 

The  discrepancy  between  Gyro-A  and  B  should  have  raised  major  con¬ 
cerns  among  the  FOT.  Roll  rate  confirmation  could  have  been  deduced 
from  sun  sensor  data.  One  cannot  help  wondering  how  the  FOT  displays 
affected  correlation  of  data  from  different  telemetry  sources.  Addition¬ 
ally,  the  shutdown  of  Gyro-B  apparently  violated  standing  procedures.  A 
Materials  Review  Board  (MRB)  should  be  convened  to  review  disabling  a 
key  component  like  a  gyro.  The  ESR’s  48-hour  duration  would  have  per¬ 
mitted  convening  a  MRB.  The  FOT  mission  manager  made  the  hurried 
decision  with  the  advice  of  a  Matra  Marconi  Space  (MMS)  engineer. 

7.  Failure  to  recognize  risk  caused  by  operation’s  team  overload. 

The  calibration  and  reconfiguration  was  meant  to  support  a  plaimed  week 
of  scientific  observations  and  insufficient  time  was  programmed  to  ac¬ 
complish  them,  thus  the  hurried  decisions.  Such  a  compressed  timeline 
had  never  been  previously  attempted  and  was  to  be  accomplished  without 
any  staff  augmentation.  The  ESR  events  were  viewed  as  obstacles  to  ac¬ 
complishing  the  science  schedule  instead  of  as  threats  to  the  spacecraft’s 
health.  ESR-6  occurred  when  the  MMS  engineer  was  troubleshooting  the 
upcoming  science  maneuvers  in  NASA  and  ESA  simulators. 

8.  Failure  to  recognize  shortcomings  in  implementation  of  ESA/NASA 
agreements. 
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9.  Emphasis  on  science  returns  was  achieved  at  the  expense  of  spacecraft 
safety. 

The  investigation  board  criticizes  the  decision  to  place  management 
authority  for  the  spacecraft  with  the  SOHO  Project  Scientist.  The  investi¬ 
gators  indicate  there  was  a  bias  toward  science  and  a  lack  of  proper  regard 
for  spacecraft  health  and  safety.  Who  should  be  responsible  for  a  space¬ 
craft  is  the  clear  issue  and  engineering  knowledge  of  the  craft’s  design  and 
operation  appears  to  be  the  cracial  criteria. 

10.  Over-reliance  of  EOT  on  ESA  and  MMS  representatives. 

Manning  levels  and  qualifications  are  a  continuing  theme  throughout  the 
report.  The  SOHO  EOT  had  minimal  training  in  the  design  and  unique 
characteristics  of  the  satellite  for  which  they  were  responsible.  They  re¬ 
lied  heavily  on  one  each  ESA  and  MMS  engineers  who  were  knowledge¬ 
able  in  the  SOHO’s  characteristics.  However,  neither  the  EOT  nor  the  en¬ 
gineer  representatives  knew  TSTOL,  the  computer  language  used  to  pre¬ 
define  procedural  sequences  of  ground-generated  commands.  Thus,  no¬ 
body  operating  SOHO  knew  enough  to  detect  the  A_CONEIG_N  script  er¬ 
ror! 

1 1 .  Dilution  of  observatory  engineering  support. 

In  addition  to  marginal  training,  the  EOT’s  workload  was  excessively 
high.  They  were  responsible  for  on-line  real-time  control  of  SOHO,  off¬ 
line  analysis,  troubleshooting  Control  Center  problems,  and  support  on¬ 
going  ISTP  re-engineering  activities.  The  Control  Center  support  con¬ 
tractor,  Allied  Signal,  decided  to  eliminate  the  Lead  Engineer  position  and 
distribute  responsibilities  across  the  Observatory  Engineers  and  Elight  Op¬ 
erations  Manager.  The  EOT  had  no  clear  management  focus  and  little 
flexibility  in  managing  their  ever-increasing  workload.  This  created  an 
atmosphere  ripe  for  faulty  decision  processes. 

12.  EaUure  to  resolve  critical  deficiency  report  in  a  timely  manner. 

The  lack  of  situation  awareness  of  Gyro- A’ s  shut  down  condition  was  ap¬ 
parently  a  display  problem.  SOHO  stores  the  last  three  telemetry  frames 
that  precede  a  safe  mode  (ESR)  entry  and  transmits  them  to  the  control 
center.  A  deficiency  report  written  4  years  before  the  accident  stated  that 
“the  SOHO  control  center  was  unable  to  display  this  data  in  a  convenient 
(user  friendly)  format,  was  never  resolved.  Ironically,  this  feature  had 
been  included  into  the  newly  configured  International  Solar  and  Terrestrial 
Program  (ISTP)  Mission  Operations  Control  (IMOC)  Center;  and  although 
the  POT  had  been  resident  in  the  IMOC  when  the  first  safe  mode  entry 
was  triggered  (ESR-5),  the  frozen  data  were  not  displayed.  Had  it  been 
displayed,  it  would  have  become  evident  that  Gyro-A  was  not  spirming. 
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and  the  sequence  of  events  that  followed  should  have  been  avoided.” 
(page  15) 

13.  Failure  to  validate  the  planned  sequence  of  events  in  advance. 

Inadequate  testing  was  identified  as  a  contributing  cause  to  the  mishap. 
Event  scripts  were  used  without  imdergoing  the  required  quality  control 
testing. 

The  investigation  board  has  done  a  superb  job  of  describing  the  events  and  root 
causes  behind  those  events  that  led  to  the  loss  of  the  SOHO  satellite.  Clearly,  nearly  all  the 
identified  contributing  causes  are  human  factors  related.  However,  the  report  is  framed  in  an  en¬ 
gineering  process  perspective;  the  only  mention  of  human  factors  is  the  acknowledgement  of  Dr. 
Mitchell  of  Georgia  Tech  as  a  consultant.  Dr.  Mitchell  apparently  made  significant  input  into  the 
analysis,  but  the  report  fails  to  identify  the  human  factors  issues  as  such.  It  is  interesting  to  note 
that  no  one  from  either  NASA  or  ESA  with  human  factors  experience  participated  in  the  investi¬ 
gation  board.  This  lack  of  participation  indicates  that  NASA’s  considerable  human  factors  capa¬ 
bilities  are  not  generally  engaged  in  ground  station  display  and  control  design. 

3.2.3.  ESA  Lessons  Learned 

Winuner  (1997)  discusses  case  studies  of  four  ESA  satellite  failures  and  their 
causes.  A  unique  approach  was  used,  referring  to  the  problem  missions  anonymously  thus 
avoiding  pointing  fingers  at  particular  programs.  This  protection  is  not  foolproof,  as  people 
knowledgeable  in  the  ESA  Program  may  readily  identify  the  missions  from  their  descriptions. 
However,  it  is  the  kind  of  gesture  needed  to  focus  attention  on  the  problems  and  lessons  learned 
and  not  on  the  programs. 

Two  of  the  four  satellites  described  experienced  ground  controller  error  as  part  of 
their  on-orbit  anomalies.  Mission  2  was  a  communications  satellite  flown  in  the  late  1980’s  and 
early  1990’s  with  an  elliptical  transfer  orbit  to  a  geostationary  orbit.  Multiple  on-board  failures 
were  confounded  by  operator  errors  during  emergency  sun  re-acquisition.  The  result  was  loss  of 
attitude  control  and  draining  of  the  spacecraft’s  batteries.  Three  weeks  later,  incidental  charging 
permitted  re-establishing  contact  with  the  satellite  and  its  eventual  recovery.  Mission  life  was 
shortened  by  increased  fiiel  recovery  and  damage  from  the  satellite’s  weeks  outside  of  its  design 
parameters. 


Mission  3  was  an  astronomical  science  payload  in  an  elliptical  orbit  resulting 
from  an  apogee  motor  failure  to  fire  to  create  the  intended  geosynchronous  orbit.  The  science 
mission  was  still  possible  given  the  imusual  orbit,  but  that  orbital  deviation  significantly  in¬ 
creased  the  workload  of  the  ground  controllers.  The  situation  was  further  compounded  by  addi¬ 
tional  failures  in  the  gyros,  star  mapper,  and  thermal  control  systems.  Wimmer  states  ‘The  dan¬ 
ger  caused  by  operator  and  procedural  errors  was  largely  a  consequence  of  additional  operational 
complexities  caused  by  the  new  and  much  more  constrained  orbital  environment.  Frequent  and 
rapid  implementations  of  procedural  changes  were  required.  The  most  serious  human  error  oc¬ 
curred  when  a  ground  controller  uplinked  a  command  which  omitted  a  velocity  with  its  exponent 
missing  (lO"^).  This  caused  the  spacecraft  to  depart  from  its  normal  spin  rate  of 
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-168.75  arc  sec/sec,  transit  through  0  spin,  and  start  spinning  up  in  the  opposite  direction!  For¬ 
tunately,  the  departure  from  normal  spin  was  detected  and  the  forces  were  small  enough  to  cor¬ 
rect  the  condition  without  damage  to  the  spacecraft. 

Although  not  an  example  of  human  error.  Mission  4  illustrated  how  on-board 
autonomous  behaviors  can  have  a  negative  impact  on  controller  workload.  This  mission  was  a 
microgravity  scientific  payload  in  low  earth  orbit  requiring  recovery.  Developed  on  a  “cost  cut¬ 
ting”  budget,  there  was  insufficient  testing  of  its  on-board  automation.  The  mission  would  have 
been  in  serious  danger  if  controllers  had  not  inhibited  major  fault  management  routines.  As 
workaround  procedures  were  developed  as  the  mission  progressed,  the  danger  for  controller  error 
significantly  increased.  The  controllers  prevailed  and  100%  of  the  mission  objectives  were 
achieved,  but  the  message  is  clear.  Modifying  procedures  to  cope  with  failures  and  faulty  auto¬ 
mation  significantly  increases  the  opportunity  for  human  error. 

There  are  several  recommendations  Wimmer  makes  concerning  the  life  cycle  of 
space  missions.  The  ones  most  appropriate  to  human  factors  are  listed  below. 

For  project  management: 

•  Ensure  proper  funding  for  adequate  staffing  of  mission  control  teams; 

•  The  design  and  trade-off  processes  must  refer  to  the  entire  system,  i.e., 
space  and  ground  segments  and  mission  objectives  as  well  as  to  cost/risk 
or  cost/mission  success  probabilities; 

•  Allocate  adequate  industrial  resources  for  operations  analysis,  preparation 
of  operations-related  documents  (user’s  manuals),  contingency  recovery 
analysis  in  a  timely  fashion,  etc.,  and  prevent  resource  diversion; 

•  Accept  recommendations  from  industry  for  problem  workaround  solutions 
only  with  the  concurrence  of  the  project-specific  operations  team; 

•  Provide  operations  related  test  and  failure  reports  to  the  operations  team; 
and 

•  On-board  software  maintenance  must  be  co-located  at  the  Mission  Control 
Center  (MCC)~the  function  must  be  ftilly-operational  from  the  launch. 

For  spacecraft  design/development/test  phases: 

•  Design  to  allow  enable/disable  interrogation  for  all  critical  on-board  con¬ 
trol  processes; 

•  Ensure  parametric  feed  back  in  the  telemetry  of  any  control  parameter  in 
any  critical  control  process; 

•  Ensure  the  availability  of  sufficient  functional  flexibility  for  the  introduc¬ 
tion  of  workaround  fault  solutions;  and 

•  Ensure  timely  delivery  of  adequate  and  factually  correct  user-manual 
documentation  (this  must  also  cover  the  characteristics  and  side  effects  of 
all  introduced  workaround  solutions). 
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For  mission  control: 


•  Ensure  the  availability  of  operational  expertise  and  proper  team  build-up 
throughout  the  design/development  phases  of  a  project— close  collabora¬ 
tion  between  project  and  industry  (and,  if  applicable,  other  control  centers 
involved)  is  mandatory; 

•  Ensure  adequate  procedural  coverage  of  all  mission-critical  activities,  in¬ 
cluding  contingency  recoveries; 

•  Update  and  validate  operational  procedures  rapidly— subsequent  to  satellite 
degradation  events; 

•  Ensure  the  delivery  of  an  accepted  ground  segment  at  least  six  months 
prior  to  launch; 

•  Ensure  all  facilities  and  support  functions  from  all  ground  segment  ele¬ 
ments  are  available  during  acceptance  tests;  and 

•  Ensure  the  timely  availability  of  an  adequately  realistic  simulator. 

These  reconunendations  are  fertile  grounds  for  research,  which  could  significantly 
improve  ground  control  of  space  operations. 

3.2.4.  Mars  Climate  Orbiter  Loss 

The  Mars  Climate  Orbiter  (MCO)  was  launched  on  1 1  December  1998  to  provide 
weather  information  from  Mars  and  to  provide  primary  conununications  links  for  the  trailing 
Mars  Polar  Lander  (MPL).  Part  of  NASA’s  new  smaller,  faster,  and  cheaper  design  philosophy; 
MCO  was  developed  with  several  cost  saving  features.  One  feature  was  the  use  of  aerobraking— 
a  trajectory  that  skims  the  target  planet’s  atmosphere  to  reduce  spacecraft  velocity  and  permit 
Mars’s  gravity  to  capture  MCO  in  orbit.  The  Mars  Orbit  Insertion  was  performed  on  23  Septem¬ 
ber  1999.  Sometime  following  Mars’s  occultation  and  during  aerobraking,  contact  with  MCO 
was  lost  and  the  mission  was  declared  a  failure.  An  accident  board  was  hiuriedly  convened  out 
of  concern  for  the  MPL,  which  was  several  weeks  behind  MCO  and  which  MCO  was  provided 
conununications  links.  The  findings  of  this  board  were  published  before  MPL’s  Mars  encounter 
(NASA,  10  November  1999). 

A  definitive  cause  for  MCO’s  loss  was  determined  through  records  of  its  trajec¬ 
tory.  The  MCO’s  aerobraking  was  planned  to  occur  at  an  altitude  of  210-226  km  above  the 
Martian  surface.  A  Trajectory  Correction  Maneuver  (TCM-4)  was  planned  and  executed  on  15 
September  1999.  Twenty-four  hours  before  Mars  Orbital  Insertion  (MOI),  tracking  data  indi¬ 
cated  that  the  spacecraft  might  travel  as  close  as  1 10  km  to  the  surface;  minimum  smvival  alti¬ 
tude  was  80  km.  The  MOI  engine  start  took  place  on  23  September  1999  and  Mars  occlusion 
occurred  49  seconds  earlier  than  predicted.  There  was  no  further  communications  with  the 
spacecraft.  Further  analysis  of  tracking  data  coupled  with  the  earlier  than  expected  loss  of  signal 
led  investigators  to  believe  that  the  spacecraft  entered  the  Mars  atmosphere  at  57  km.  This  was 
below  the  minimum  survivable  altitude,  and  that  the  spacecraft  likely  burned  up  in  the  Mars  at¬ 
mosphere  or  after  severe  damage,  skipped  back  into  planetary  space.  The  investigation  board 
focused  on  how  the  trajectory  error  was  made— the  answer  was  startling  simple. 
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A  feature  of  MCO’s  design  was  the  use  of  an  asymmetrical  configuration  of  solar 
panels.  A  single  solar  panel  projected  from  one  side  of  the  spacecraft  (see  Figure  3.2.4- 1). 
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Figure  3.2.4-l.The  MCO  Spacecraft  With  Its  Pronounced  Asymmetrical  Configuration  (NASA). 

This  configuration  causes  asymmetrical  forces  from  solar  wind,  causing  both 
spacecraft  rotation  and  deviation  from  the  intended  trajectory.  A  software  package  called  “Small 
Forces”  (SM_FORCES)  is  used  by  Jet  Propulsion  Laboratory  (JPL)  navigators  to  track  the  ef¬ 
fects  of  the  solar  wind.  Output  of  SM_FORCES  is  a  file  called  the  Angular  Momentum  Desatu¬ 
ration  (AMD).  Both  SM_FORCES  and  AMD  Software  Interface  Specification  (SIS)  call  for 
forces  to  be  input  in  Newton-seconds  (N-s)— the  appropriate  metric  measure  for  thrust.  The 
SM_FORCES  inputs  were  erroneously  made  in  English  units  of  pounds-seconds  (Ibf-s)  instead 
of  N-s,  resulting  in  AMD  file  errors  too  large  by  a  factor  of  4.45~the  conversion  factor  between 
Ibf-s  to  N-s.  The  JPL  navigators  used  the  flawed  AMD  file  to  compute  TCM-4  and  that  engine 
bum  produced  the  fatally  low  encoimter  with  the  Martian  atmosphere. 

A  series  of  contributing  causes  were  identified  by  the  MCO  Accident  Investiga¬ 
tion  Board  and  are  listed  below  with  conunentary. 

1 .  Modeling  of  spacecraft  velocity  changes. 

Software  problems  with  the  AMD  file  prevented  its  use  during  early  parts 
of  the  MCO’s  planetary  transit.  The  output  of  AMD  was  known  to  be 
anomalous,  but  the  root  cause  of  the  errors  was  never  identified.  Direct 
observation  by  radar  Doppler  shift  was  not  possible  because  AMD  correc¬ 
tions  occurred  at  right  angles  to  the  line-of-sight,  rendering  Doppler  shift 
measurements  impossible.  Thus,  the  errors  persisted  until  the  MOI  inci¬ 
dent. 
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2.  Knowledge  of  spacecraft  characteristics. 

The  investigators  detected  a  fundamental  lack  of  knowledge  among  the 
navigation  team  about  the  characteristics  of  the  MCO  spacecraft.  A  dif¬ 
ferent  navigation  team  was  used  during  design  and  development,  with  the 
operations  navigation  team  joining  the  project  only  shortly  before  launch. 
This  lack  of  understanding  about  MCO  and  especially  small  force  man¬ 
agement  allowed  the  errors  in  their  management  to  persist. 

3.  TCM-5. 

Concern  about  the  lower  than  anticipated  (but  still  within  survivable  pa¬ 
rameters)  altitude  for  MOI  produced  discussion  about  an  additional  TCM- 
5.  However,  there  was  no  detailed  planning  for  an  additional  TCM  and 
there  was  considerable  time  pressure  to  achieve  final  orbital  parameters 
before  the  following  MPL  attempted  its  landing.  The  situation  was  com¬ 
pounded  by  a  failure  of  the  spacecraft  operations  and  navigation  teams  to 
understand  the  potential  criticality  of  TCM-5.  TCM-5  could  have  pre¬ 
vented  the  loss  of  MCO,  but  was  never  performed. 

4.  Systems  engineering  process. 

The  asymmetrical  design  of  MCO  significantly  contributed  to  the  naviga¬ 
tion  team’s  workload.  Originally,  a  daily  180°  flip  or  so-called  “barbecue 
mode”  was  planned  to  eliminate  the  solar  wind  effects.  Trade-off  studies 
later  determined  that  this  was  unnecessary  and  it  was  deleted  from  the 
mission  profile.  The  consequence  was  that  AMD  triggered  thruster  firings 
occurred  10-14  times  more  frequently  than  anticipated  in  mission  plan¬ 
ning.  The  accumulated  effects  of  the  error  in  these  firings  over  the  nine 
month  transit  to  Mars  were  what  produced  the  trajectory  error.  The  barbe¬ 
cue  mode  would  have  eliminated  most  of  these  firings  and  resulted  in  a 
survivable  error. 

5.  Communication  among  project  elements. 

Fundamental  failures  in  communication  seem  to  underlay  the  MCO  loss. 
The  navigation  team  assumed  that  MCO  was  similar  to  the  earlier  Mars 
Global  Surveyor  (MGS)  and  resulted  in  the  navigation  team  failure  to  un¬ 
derstand  MCO  operation.  Whenever  discrepancies  in  operations  or  navi¬ 
gation  occurred,  the  teams  relied  on  e-mail  instead  of  the  established  Inci¬ 
dent  Surprise  Anomaly  (ISA)  reporting  procedure.  This  prevented  in¬ 
volvement  of  others  that  might  have  detected  the  flaws  in  navigation  and 
operations. 
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Another  communications  issue  reported  in  the  press,  but  not  mentioned  by 
the  accident  investigation  board  was  that  MCO’s  builder,  Lockheed  Mar¬ 
tin,  used  English  measurements  in  its  design  and  development  while 
NASA/JPL  navigators  used  metric  measurements.  Any  engineering  stu¬ 
dent  knows  measurements  such  as  those  in  thrust,  especially  when  small  in 
magnitude,  are  easily  confused.  Such  a  fundamental  difference  between 
fabricator  and  user  seems  boimd  to  create  difficulties! 

6.  Operations  navigation  team  staffing. 

The  Mars  Surveyor  Operations  Project  was  running  three  missions  (MGS, 
MCO,  and  MPL)  simultaneously.  Navigation  responsibility  was  handled 
by  the  navigation  team  lead  (also  with  responsibilities  for  the  other  two 
missions)  and  a  single  MCO  navigator.  Three  Ml-time  navigators  were 
deemed  adequate  staffing,  so  >2  was  far  less  than  necessary.  Personnel 
costs  are  a  large  part  of  overall  program  costs  and  this  may  be  a  case  of 
where  smaller,  faster,  and  better  contributed  to  the  MCO  loss. 

7.  Training  of  personnel. 

As  mentioned  earlier,  the  MCO  navigation  team  had  insufficient  knowl¬ 
edge  of  the  design  and  development  of  the  spacecraft  to  adequately  under¬ 
stand  the  problems  they  were  experiencing.  Some  of  the  MCO  team 
members  were  also  unfamiliar  with  ISA  reporting  procedures  and  why  it  is 
so  important.  The  developers  of  the  SM_FORCES  software  needed  addi¬ 
tional  training  in  following  SIS  guidelines.  SM_FORCES  Program  and 
AMD  file  users  were  inadequately  trained  in  the  use  of  that  software. 

8.  Verification  and  validation  process. 

The  software  development  process  for  SMJFORCES  and  the  AMD  file 
were  seriously  flawed.  Late  in  development  and  buggy,  neither  was  prop¬ 
erly  tested  and  no  independent  verification  and  validation  was  performed. 
No  system  verification  matrix  was  developed  and  Interface  Control 
Documents  (ICDs)  were  not  followed.  One  cannot  help  to  speculate 
whether  the  SM_FORCES  Program  and  AMD  files  prominently  labeled 
the  unit’s  input  and  output. 

The  composition  of  the  MCO  accident  board  is  worthy  of  notice.  The  board’s  19 
members,  advisors,  and  consultants  do  not  include  any  human  factors  engineering  or  engineering 
psychology  members.  Recall  that  the  SOHO  investigation  board  at  least  had  a  human  factors 
consultant.  This  exclusion  of  the  human  factors  community,  in  investigating  an  accident  whose 
causes  are  largely  based  in  hiunan  error,  indicates  the  bias  engineers  have  toward  system  purely 
engineering  views  of  design,  development,  operations,  and  apparently  investigation  of  failures. 
There  are  no  guarantees  that  greater  human  engineering  participation  in  MCO’s  design  and  de¬ 
velopment  would  have  prevented  spacecraft  loss.  However,  display  design  for  SM_FORCES 
might  have  improved  labeling  of  its  units  of  measurement.  Management  displays  of  AMD  ma- 
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neuvers  exceeding  expectations  by  10-15  times  might  have  raised  flags  about  the  accuracy  and 
effects  of  such  maneuvers.  More  graphical  modeling  and  navigation  displays  might  have  per¬ 
mitted  detection  of  the  navigation  error.  Unfortunately,  human  factors  engineering  is  one  of  the 
first  casualties  of  any  cost-saving  campaign. 
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4.  EXISTING  RESEARCH  LITERATURE 


Previously,  we  have  described  press  reports  concerning  human  error  in  spacecraft 
operations  and  looked  at  several  reports  in  detail  concerning  investigations  of  spacecraft  losses. 
Only  one  of  these  publications  was  part  of  a  published  scientific  paper-Wimmer  (1997).  A  lit¬ 
erature  review  was  conducted  to  identify  directly  related  research  published  concerning  space¬ 
craft  control  displays  and  controls.  Apparently,  there  have  been  relatively  little  published  in  sci¬ 
entific  journals  about  ground  controller  human  factors  during  the  43  years  of  such  operations. 

4.1.  Factors  Inhibiting  Open  Literature  on  Sateilite  Control 

Conversations  with  Government,  Government  contractors,  and  commercial  peo¬ 
ple  involved  with  satellite  control  reveal  significant  reasons  why  the  satellite  control  literature  is 
small.  First,  reports  of  human  error  represent  an  embarrassment  which  both  the  Government, 
military,  and  private  companies  would  rather  not  publicize.  There  is  apparently  no  separate  sat¬ 
ellite  control  human  error  data  base  with  controller  errors  being  handled  at  program-level  unless 
there  is  a  “public”  loss  of  the  satellite  or  its  services.  This  tmwillingness  to  reveal  errors  prevents 
sharing  of  information  across  programs  within  the  Government  and  between  Government  and 
industry.  Clearly,  some  form  of  anonymous  reporting  of  human  errors  is  needed  like  the  one  the 
FAA  maintains  for  aircraft  operations. 

Second,  satellite  displays  and  controls  ate  typically  the  domain  of  production 
software  engineers,  who  burdened  by  delivery  schedule,  do  not  typically  publish  beyond  internal 
documentation.  Little  or  no  participation  by  human  factors  specialists  in  the  accident  reports  be¬ 
lies  the  fact  that  such  specialists  are  not  typically  called  upon  to  design  ground  controller  dis¬ 
plays  and  controls.  This  apparently  is  trae  even  in  NASA,  which  has  a  significant  human  factors 
establishment.  The  logic  appears  to  be  that  unmanned  spacecraft  operations  do  not  need  human 
factors  engineering,  much  less  research. 

4.2.  Previous  Scientific  Literature 

Brody  (1993)  provides  a  brief  summary  of  NASA  human  factors  research  in  sup¬ 
port  of  the  maimed  spaceflight  program.  Although  he  notes  that  space  station  crews  will  spend 
roughly  40%  of  their  productive  time  at  workstations,  he  only  mentions  ergonomic  aspects  of 
those  workstation’s  design.  There  is  no  mention  of  ground  controller  station  design  efforts,  a 
significant  omission,  which  suggests  the  subject  has  not  received  much  attention  from  the  NASA 
human  factors  community. 

An  Air  Force  author  (Charleton,  1992)  studied  satellite  grovmd  station  controls  in 
a  series  of  quasi-experiments  at  Onizuka  Air  Force,  CA.  A  series  of  questionnaires  were  admin¬ 
istered  to  controllers  who  were  also  observed  during  satellite  Contact  Support  Plan  (CSP)  opera¬ 
tions.  The  goal  was  to  establish  an  observational  and  questionnaire  method  which  could  be  em¬ 
ployed  on  a  non-interference  basis  in  operational  satellite  control  centers. 

In  the  first  experiment,  multiple  regressions  were  calculated  relating  performance 
measures  (CSP  execution  time,  prepass  execution  time,  contact  execution  time,  and  operator  er¬ 
rors)  with  human  factors  measures  (event  counts,  questionnaire  ratings).  Charleton  found  sig- 
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nificant  multiple  (.33-.79)  relating  both  event  counts  (alarms  encountered,  warnings  encoun¬ 
tered)  and  questionnaire  ratings  (equipment  design,  noise  levels,  and  fatigue). 

In  his  second  experiment,  Charleton  refines  both  his  questionnaire  (more  specific 
questions)  and  his  performance  measures  (breakdowns  of  errors  and  times  to  complete)  and  ap¬ 
plied  them  to  a  larger  sample  of  satellite  contacts  and  operators.  The  reported  multiple  are 
larger  (.31 -.90),  indicating  his  refinements  are  explaining  more  of  the  data’s  variance.  In  a  third 
experiment,  the  findings  are  replicated  at  the  Air  Force  Consolidated  Space  Operations  Center 
(CSOC)  Colorado  Springs,  CO.  Multiple  R^  reported  here  on  a  different  set  of  tasks  (includes 
workload,  specific  equipment  design,  operator  software  interface)  range  from  .06  -.79,  with 
smaller  ones  being  achieved  with  more  detailed  performance  measures  (time  to  return  resources, 
time  to  log  off). 

Charleton’s  work  with  Air  Force  space  operators  demonstrates  that  non-invasive 
research  can  be  done  even  in  sensitive  control  facilities.  He  identifies  specific  problems  from  his 
observations  such  as  configuration  data  base  and  telemetry  routing  test  procedures.  Audio  noise 
was  also  identified  which  interfered  with  critical  communications.  These  findings  not  only  con¬ 
tribute  to  the  human-computer  interface  literature,  but  the  specific  problem  isolation  can  lead  to 
significant  improvements  in  control  center  operations. 

Erickson,  Hammer,  Kahn,  and  Kazz  (1995)  did  a  case  smdy  of  mission  operations 
for  the  Mars  Observer  (MO)  mission.  This  mission  ended  in  failure  when  spacecraft  contact  was 
lost  on  21  August  1992  with  a  hardware  failure  in  the  propulsion  system— the  most  probable 
cause  (Cunningham,  1997).  Several  iimovative  changes  were  made  in  MO’s  control— the  first 
mission  based  on  lower  cost  and  more  limited  scientific  objectives.  Each  of  the  innovations  is 
described  and  their  outcomes  explained.  Many  of  these  innovations  are  human  factors  based  or 
have  human  factor  implications. 

The  first  innovation  was  a  distributed  information  architecture,  which  permitted 
remote  science  and  engineering  operations.  The  Magellan  spacecraft  had  pioneered  in  this  con¬ 
cept  which  permits  principal  investigators  to  conduct  their  science  from  the  comfort  of  their 
normal  facilities.  This  approach  was  seen  as  a  resounding  success,  achieving  lower  operating 
costs,  increasing  productivity,  and  happier  scientists  who  were  not  forced  to  relocate  to  the  con¬ 
trol  center. 


Part  of  the  ground  system  development  to  support  MO  was  the  Science  Opera¬ 
tions  and  Planning  Computer  (SOPC).  This  was  intended  to  be  a  standardized  workstation  to 
control  instrument  operations  and  to  perform  science  data  processing  as  a  secondary  role.  A 
common  workstation  was  intended  to  reduce  or  eliminate  customized  developments  by  individ¬ 
ual  investigators.  The  outcome  was  somewhat  mixed.  As  some  investigators  embraced  the 
SOPC  and  used  it  exclusively,  others  limited  it  to  interfacing  with  their  own  host  computers. 

The  MO  spacecraft  was  the  first  to  employ  multi-mission  support  services— em¬ 
ploying  the  Deep  Space  Network,  Advanced  Multi-Mission  Operations  Center,  and  the  Multi- 
Mission  Navigation  Organization.  The  authors  report  that  costs  were  somewhat  higher  than  an¬ 
ticipated  and  changes  during  the  flight  to  accommodate  the  multi-mission  approach  were  more 
difficult  and  intrasive  than  anticipated.  These  disadvantages  were  still  offset  by  significant  cost 
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savings  compared  to  a  similar  single-mission  project.  Unfortunately,  there  is  no  anticipation  of 
the  workload-related  problems  of  the  multi-mission  navigation  organization  seven  years  later  on 
theMCO. 


The  control  theory  community  is  actively  pursuing  and  struggling  with  the  issue 
of  autonomous  control  of  spacecraft  using  artificial  intelligence  (AI).  Wan,  Braspenning,  and 
Vreeswijk  (1995)  review  the  issues  associated  with  AI  control  of  spacecraft.  The  ESA  (Pidgeon, 
Seaton,  Howard,  and  Peters,  1992)  published  the  Standard  Generic  Approach  to  Spacecraft 
Autonomy  and  Automation  (SGASAA).  This  document  specifies  high-level,  ground-control 
conunand  sequences  or  goals  as  specified  by  a  Master  Schedule  and  an  on-board  management 
system  to  manage  accomplishment  of  the  goals,  and  a  check-out  mode  for  fault  correction.  Wan 
et  al.  claimed  that  a  SGASSA  spacecraft  is  not  autonomous  because  of  the  Master  Schedule, 
human  intervention  is  very  likely,  and  the  on-board  fault  correction  cannot  handle  unforeseen 
problems. 


The  alternative  approach  involves  a  distributed  AI  multi-agent  system  (MAS)  that 
can  perform  Distributed  Problem  Solving  (DPS).  A  theoretic  discourse  dealing  with  the  adaptive 
nature  of  the  MAS/DPS  architecture,  how  it  fits  into  classical  control  law  thinking,  and  the  basis 
necessary  conditions  for  a  true  autonomous  system  ensues.  In  an  earlier  work,  Easter  and  Staehl 
(1984)  asserted  that  autonomous  spacecraft  operations  are  neither  achievable  nor  desirable.  Wan 
et  al.  believed  that  such  control  can  be  achieved,  but  that  such  systems  might  perform  “better  if 
ground-control  recommendation  is  available.” 

Wan  et  al.  highlights  the  different  levels  of  argument  concerning  the  capabilities 
and  the  desirability  of  spacecraft  automation.  NASA’s  experiments  with  their  Remote  Agent  on 
the  Deep  Space  1  spacecraft  reflect  early  efforts  to  define  the  boundary  conditions  of  autono¬ 
mous  operations.  If  we  are  to  believe  the  continuing  role  for  ground  control  advocated  in  their 
conclusions,  what  sort  of  displays  and  controls  will  be  needed  to  facilitate  interaction  between 
the  autonomous  MAS/DPS  spacecraft  and  its  human  “controllers?”  Such  displays  must  go  be¬ 
yond  simple  telemetry,  but  allow  interaction  with  the  AI’s  line  of  reasoning  so  that  ground  con¬ 
trol  can  offer  advice  and/or  consent  in  a  meaningful  fashion.  This  will  add  an  entirely  new  di¬ 
mension  to  the  human-computer  interface  and  it  is  one  anticipated  by  such  scientific  authors  as 
Arthur  C.  Clarke  and  Gene  Roddenbury. 

Shalin  (1999)  reports  on  a  work  in  progress  for  NASA’s  Johnson  Manned  Space- 
flight  Center  that  is  examining  the  complex  and  d)niamic  distributed  work  environment  of  the 
MCC.  In  the  first  year,  she  performed  a  thorough  observational  study  of  the  MCC  in  general  and 
the  Flight  Dynamics  Officers  (FDOs)  specifically.  This  included  direct  observations  made  on 
the  MCC  floor  during  a  Space  Shuttle  mission.  These  observations  were  coupled  with  NASA 
documentation,  critical  incident  reviews,  public  domain  information,  and  audio-visual  recordings 
provided  a  comprehensive  view  of  the  FDO  function.  Several  representations  of  this  function, 
including  Plan-Goal  Graphing  (PPG,  Sewell,  and  Geddes,  1990)  are  part  of  the  domain  analysis 
that  was  performed.  The  analysis  identified  ten  issues  associated  with  improving  MCC  function 
through  technology:  distinguishing  different  computer  models  by  enumeration,  the  proliferation 
of  models,  the  integration  of  multiple  tagged  constraints  resulting  from  several  different  mathe¬ 
matical  processing  tools,  the  selection  of  parameter  values,  processing  time  delays  in  the  context 
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of  interrupted  time  pressured  work,  and  facilitating  the  reporting  of  software  anomalies.  These 
findings  seem  to  match  some  of  the  root  causes  for  the  MCO  spacecraft  loss. 

Shalin’s  research  plan  describes  her  intentions  to  expand  her  observation  and 
analysis  to  several  other  flight  controller  positions  (communications,  payload,  etc.)  with  which 
the  FDO  must  work  closely.  The  domain  analysis  will  be  expanded  with  emphasis  on  collabora¬ 
tion.  Additionally,  technology  development  to  address  the  first  two  of  the  issues  described  above 
will  be  facilitated.  Certainly  Shalin’s  location  at  Wright  State  University  makes  her  an  excellent 
candidate  for  future  collaboration. 

4.3.  Technology  Trends  in  Satellite  Operations 

The  newest  development  in  satellite  control  is  the  development  of  Remote  Agent 
(RA)  by  NASA.  RA  is  an  artificial  intelligence-based  software  that  can  autonomously  control 
spacecraft  operations  without  ground  controller  intervention.  RA  was  incorporated  by  NASA 
into  the  Deep  Space  1  (DSl)  spacecraft,  which  employed  several  experimental  technologies. 

The  RA  software  is  written  in  LISP  and  C-h-  and  is  composed  of  three  parts:  the 
planner  scheduler  (PS),  the  smart  executive  (EXEC),  and  the  mode  identification  and  recovery 
(MIR).  PS  produces  flexible  plans  and  specifies  activities  to  accomplish  mission  goals.  EXEC 
carries  out  PS’s  plans  in  a  “smart”  fashion.  MIR,  a.k.a.  Livingston,  monitors  the  health  of  the 
spacecraft  and  corrects  problems  as  they  occur.  The  three  programs  communicate  with  each 
other  so  that  faults  and  their  correction  can  generate  modified  plans  and  variations  in  execution. 

The  performance  of  RA  on  DSl  has  been  hailed  a  success  although  not  without 
some  faults  (McHale,  1999).  Livingston  successfully  reconfigured  the  spacecraft  when  “faults” 
were  introduced  in  a  sensor— when  a  thruster  failure  was  induced,  rebooted  a  “failed”  subsystem, 
and  modified  power  use  when  a  camera  was  stuck  “on.”  These  induced  faults  triggered  changes 
by  PS  and  in  EXEC.  The  testing  has  found  some  faults.  RA  successfully  commanded  the  firing 
of  the  experimental  Xenon  ion  engine,  but  failed  to  shut  it  down  at  the  proper  time.  A  software 
glitch  affected  RA’s  function,  but  the  MIR  software  even  went  as  far  to  suggest  possible  sources 
for  the  bug.  Later,  RA  would  successfully  plan  and  execute  an  encounter  with  an  asteroid,  but 
DSl’s  camera  was  not  properly  aimed  at  the  object. 

Operator  interaction  with  autonomous  operations  is  an  issue  in  a  number  of  dif¬ 
ferent  satellite  and  uninhabited  air  vehicle  (UAV)  systems.  Bames,  Wickens  and  Smith  (2000) 
have  data  indicating  that  operators  over-intervened  in  a  missile  defense  simulation— degrading 
system  performance.  Excluding  operator  intervention  altogether  can  have  dire  consequences. 
The  Dark  Star  UAV  was  lost  when  the  autonomous  control  system  induced  oscillations  on  take¬ 
off.  A  stray  radio  transmission  resulted  in  a  Global  Hawk  UAV  to  execute  its  self-destruct  ma¬ 
neuver.  There  are  certainly  common  issues  of  operator  interaction  with  autonomous  systems 
between  satellite  and  UAV  control.  These  systems  share  common  problems,  though  the  decision 
and  reaction  timelines  may  differ  between  them.  How  ground  controllers  should  interact  with 
autonomous  vehicle  operations  is  an  emerging  research  issue. 
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5.  PROPOSED  HUMAN  ENGINEERING  R&D  PROGRAM 

The  preceding  sections  of  this  report  have  established  that  there  exist  significant 
human  factors  issues  associated  with  ground  control  of  spacecraft.  Operator  error  has  had  and 
will  continue  to  have  a  significant  adverse  impact  on  spacecraft  operations.  The  responsibilities 
of  ground  controllers  are  undergoing  significant  changes  with  management  of  multi-spacecraft 
constellations,  interaction  with  increasingly  autonomous  spacecraft,  and  increasing  need  for  real¬ 
time  spacecraft  control.  Currently,  training  is  difficult  because  of  the  variety  of  spacecraft,  their 
unique  characteristics,  and  their  different  user  interfaces.  There  is  an  increasing  trend  to  provide 
controllers  with  intelligent  aids  to  cope  with  increased  spacecraft  and  mission  sophistication-op¬ 
erator  interaction  with  such  aids  is  yet  another  human  factors  issue. 

Given  these  challenges  of  the  spacecraft  controller’s  job  and  the  increasing  costs 
(fiscal  and  political)  of  mission  failure,  there  is  considerable  justification  for  a  comprehensive 
human  factors  engineering  program.  Keeping  with  the  evolving  model  for  immediate  technol¬ 
ogy  transfer  to  useful  application,  which  now  dominates  DoD  research  programs,  the  proposed 
research  agenda  would  be  tightly  coupled  with  the  user  community.  Research  would  be  per¬ 
formed  as  a  necessary  prerequisite  to  solving  the  problems  plaguing  the  space  operations  com¬ 
munity.  Solutions  would  be  developed  by  AFRL  in  conjunction  with  the  Battle  Labs  and  Space 
Command’s  internal  engineering  establishment  in  a  closely  coupled  fashion.  Usability  and  vali¬ 
dation  testing  would  occur  in  the  field  with  real  controllers  to  guarantee  effectiveness  of  solu¬ 
tions.  Further,  the  test  or  prototype  systems  would  be  developed  in  such  a  fashion  that  they  can 
be  immediately  applied  to  operational  settings  or  can  be  transitioned  to  contractors  who  can  eas¬ 
ily  modify  them  for  operational  use  at  significantly  reduced  cost  to  the  Air  Force  or  commercial 
users.  Such  a  technology  development  and  transition  strategy  would  provide  the  Air  Force  with 
immediate  operational  benefits  from  AFRL  research  and  engineering  efforts. 

The  following  research  areas  are  identified  which  can  be  pursued  by  a  re¬ 
search/development  paradigm  which  can  iimnediately  transition  technical  solutions  to  the  DoD 
and  commercial  space  community,  and  through  the  engineering  and  research  necessary  for  solu¬ 
tion  development,  make  broad  contributions  to  the  human  factors/human-computer  interface  lit¬ 
erature. 


5.1 .  Program  Elements 

5.1 .1 .  Cognitive  Engineering  of  Spacecraft  Displays  and  Controls 

This  first  program  objective  is  perhaps  the  hardest  to  visualize  and  the  hardest  to 
accomplish.  Cognitive  engineering  is  a  fashionable  buzzword  in  human  factors  and  generally 
refers  to  the  application  of  the  known  phenomenon  of  cognitive  science  to  the  problems  of  user 
interface  design  (Rassmusen,  Woods,  and  others).  Current  applications  fall  short  of  the  rigor 
usually  associated  with  the  term  “engineering,”  because  the  phenomenology  of  human  cognition 
is  not  entirely  understood  and  the  methods  used  to  translate  the  science  to  application  are  crude 
at  best  (Andriole  and  Adelman,  1988).  Increasing  complexity  of  systems,  with  spacecraft  at  or 
near  the  forefront,  demand  engineering  methods  be  developed  which  can  produce  effective  and 
reliable  user  interface  designs.  Currently,  effective  interfaces  for  spacecraft  control  take  a  slow 
and  expensive  iterative  process  often  propelled  by  failme. 
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AFRL/HE  is  a  nationally  acknowledged  archive  for  user  interface  engineering 
data,  including  cognitive  data,  through  such  publications  as  the  Human  Engineering  Data  Com¬ 
pendium,  Handbook  of  Perception  and  Human  Performance,  and  the  Designer’s  Workbench. 
The  cognitive  data  from  these  publications  can  serve  as  the  basis  for  developing  specific  engi¬ 
neering  methodologies  to  create  effective  human-computer  interface  design  methods. 

Following  the  case  method  used  by  Andriole  and  Adelman,  interface  design 
problems  experienced  by  the  SOC  should  act  as  the  focal  point  for  developing  the  engineering 
methods.  Although  the  methods  will  be  used  to  solve  the  SOC  problems  specifically,  they 
should  be  general  enough  to  apply  to  other  space  problems  and  other  human-computer  interfaces. 
Among  the  engineering  methods  which  should  be  developed  are: 

•  Measure  and  predict  multi-modal  display  format  effectiveness; 

•  Measure  and  predict  mental  transformation  demands  on  the  operators; 

•  Better  cognitive  task  analysis  methods; 

•  Tailoring  displays  to  cognition  and  cognitive  task  analysis; 

•  Predicting  training  requirements  for  the  system  operators; 

•  Predicting  the  effect  of  intelligent  aids  on  system  performance;  and 

•  Prediction  of  conditions  where  operators  will  fail. 

Cognitively  engineered  designs  would  have  easier  to  understand  displays  (more 
graphical  where  appropriate),  require  fewer  mental  transformations  by  the  user,  compliment  hu¬ 
man  cognition  wiA  intelligent  aiding,  require  less  training,  and  produce  fewer  operator  errors. 

Even  if  these  methods  were  only  partially  successful,  they  would  provide  inter¬ 
face  designers  with  the  means  to  significantly  improve  the  design  process,  resulting  in  accelerate 
design  timelines,  reduce  development  cost,  and  eliminate  expensive  engineering  change  propos¬ 
als  (ECPs)  which  negatively  impact  cost  and  schedule. 

The  display  and  control  work  can  also  be  applied  to  users  of  satellite  information. 
Payload  operators  can  benefit  from  the  cognitive  engineering  effort,  making  interpretation  of 
sensor  information  easier  and  faster.  Other  potential  benefactors  are  the  Aerospace  Operations 
Centers  (AOCs)  who  must  track  status  and  manage  operations  of  multiple  satellite  systems  often 
made  up  of  multiple  satellites  to  deliver  information  and  services  to  theater  commanders.  Par¬ 
ticularly,  the  14*  AOC  at  Vandenberg  AFB,  CA  has  been  suggested  as  needing  improved  human 
engineering. 

5.1.2.  Modeling.  Distributed  Interactive  Simulation.  HLA-based  Design.  Testing.  Exer¬ 
cise.  and  Training  Paradigms 

The  operating  characteristics  of  each  spacecraft  are  modeled  during  development 
to  validate  engineering  design.  This  same  model  is  used  to  test  scripting  of  maneuvers  and  to 
help  isolate  malfunctions.  These  models  can  be  adapted  to  other  uses  by  the  HE  program. 
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Since  space  operations  are  remote  by  their  very  nature,  it  would  seem  to  matter 
little  whether  operators  at  their  consoles  were  controlling  real  spacecraft  or  their  models.  Opera¬ 
tor  interfaces  could  be  exercised  against  the  spacecraft  models  to  determine  how  the  interface 
design  affects  spacecraft  performance.  This  will  provide  the  designers  with  a  safe  and  low  cost 
testbed  with  which  to  explore  alternative  designs  quickly  and  cheaply. 

If  the  adapted  spacecraft  model  were  made  Distributed  Interactive  Simulation 
(DIS)/High-Level  Architecture  (HLA)  compliant  or  if  it  was  augmented  with  a  DIS/HLA  com¬ 
munications  module,  then  operators  could  participate  in  virtual  exercises.  First,  this  would  per¬ 
mit  more  realistic  evaluation  of  operator-user  interface  performance.  These  exercises  will  pro¬ 
vide  realistic  demands,  pacing  and  operator  workload  for  usability,  validation  testing,  and  for 
real-time  control  issues  discussed  later.  Fault  handling  and  its  effect  on  system  performance 
could  be  thoroughly  explored. 

Second,  this  would  be  of  enormous  value  in  developing  doctrine  and  tactics  for 
satellite  employment.  Commanders  would  experience  first  hand  Ae  effects  of  intelligence  or 
conununication  capabilities  fi-om  these  exercises.  SOC  personnel  can  better  understand  the  dy¬ 
namics  of  system  performance,  discover  new  strategies  for  employing  their  limited  resources, 
and  better  understand  how  system  degradation  can  effect  mission  completion. 

Third,  significant  operator  training  can  be  done  in  the  DIS/HLA  environment. 
AFRL/HE  is  already  engaged  in  training  improvement  through  the  Small  Business  Innovative 
Research  (SBIR)  Program.  SYTRONICS,  Inc.,  is  completing  a  Phase  I SBIR  that  studied  how 
Distributed  Mission  Training  (DMT)  can  be  used  in  team  training  for  space  operations.  Both 
routine  and  infrequent  procedures  can  be  trained  to  precision  using  simulators.  Fault  isolation 
could  be  realistically  trained  and  maintained.  Unusual  or  exceptional  circumstances  can  be  pre¬ 
sented  in  training  that  cannot  be  done  in  any  other  fashion.  The  50*  Space  Wing  is  already  pro¬ 
curing  and  training  with  a  variety  of  simulators.  Research  simulations  could  contribute  to  this 
effort,  drawing  AFRL/HE  and  the  operational  training  conununity  closer  together  while  still  ag¬ 
gressively  pursuing  a  research  agenda.  AFRL/HE  had  successfully  exercised  this  joint  training 
and  research  model  with  then  Strategic  Air  Command  (SAC)  with  &e  B-IB  bomber  Engineering 
Research  Simulator  (ERS).  The  ERS  was  built  as  an  interim  procedure  trainer  and  trained  air¬ 
crews  and  hosted  several  research  studies  (Marshak,  Purvis,  and  Green,  1989).  There  is  every 
reason  to  believe  that  AFSPC  might  benefit  from  the  same  kind  of  dual  agenda  shared  simulation 
for  satellite  operations. 

5.1.3.  Real-time  Control  of  Satellite  Operations 

A  shift  in  satellite  operations  is  occurring  firom  primarily  pre-scripted  and  sched¬ 
uled  operations  to  increasingly  real-time  or  near  real-time  operations.  Die  extreme  dynamics  of 
the  battlefield  in  Desert  Storm,  including  mobile  tactical  missile  launch  detection— the  resulting 
retargeting  of  air  assets,  the  rapid  paced  ground  operations,  and  missile  defense— all  suggest  an 
increased  tempo  of  satellite  operations. 

Such  extemporaneous  operations  may  be  difficult  to  pre-script  and  require  signifi¬ 
cant  operator  intervention  to  ensure  completion  of  mission  objectives.  The  shift  fi'om  scheduled 
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to  unscheduled  real-time  interaction  with  spacecraft  will  significantly  impact  operator  proce¬ 
dures.  Additionally,  there  will  be  increasing  opportunity  for  operator  error,  which  may  not  only 
affect  mission  goals,  but  also  be  a  risk  to  the  spacecraft.  Displays  and  controls  may  need  reevalu¬ 
ation  to  determine  if  they  can  still  meet  the  more  demanding  new  operating  environment.  Real¬ 
time  modeling  may  be  necessary  to  determine  the  effects  of  untested  event  scripts.  Also,  likely 
is  that  the  increased  workload  requires  greater  use  of  intelligent  agent  software  assistance  to  sat¬ 
ellite  controllers. 

5.1 .4.  Intelligent  Agent  Software  to  Aid  Satellite  Controllers 

One  current  trend  in  HCI  is  the  increasing  use  of  intelligent  agent  (lA)  software  to 
assist  operators  in  performing  their  duties.  These  agents  can  perform  a  variety  of  functions: 
monitor  operator  inputs  for  possible  errors,  suggest  courses-of-action  based  on  the  situation,  per¬ 
form  problem-solving  or  fault  isolation,  or  predict  the  outcome  of  operator  inputs.  Use  of  such 
agent  software  is  being  touted  as  a  way  to  reduce  the  size  of  crews  and  improve  operator  per¬ 
formance. 


The  human  factors  issues  associated  with  use  of  lA  software  are  not  well  under¬ 
stood.  Among  those  issues  include  how  the  AI  presents  its  input  (advise  or  direct),  how  much 
users  will  trust  the  lA,  and  how  much  justification  should  be  provided  with  its  output.  These 
same  issues  all  apply  to  lA  in  the  satellite  controller  workstation.  Design  of  LA  assistance  should 
take  into  account  the  cognitive  task  analysis  of  the  operator— delivering  assistance  only  as  re¬ 
quired.  Situations  requiring  aid  include  demand  for  technical  knowledge  beyond  operator  train¬ 
ing,  situations  where  speed  of  response  is  critical,  and  intervention  where  operators  have  com¬ 
manded  inappropriate  or  dangerous  on-board  actions. 

5.1 .5.  Monitoring  and  Supervision  of  Satellite  On-board  Automation 

Another  trend  detectable  in  spacecraft  development  is  an  increasing  reliance  on 
automation  on-board  the  spacecraft.  NASA’s  Deep  Space  1  represents  the  leading  edge  of  this 
technology,  having  automated  planning,  an  action  executive,  and  fault  isolation.  Increased 
autonomous  operation  relegates  the  ground  controller  to  a  supervisory  and  monitoring  role  rather 
than  an  active  controller.  Although  there  is  no  precedent  in  spaceflight,  there  is  considerable 
precedent  in  aircraft.  Cockpit  automation  had  a  similar  affect  on  pilots  and  a  number  of  disturb¬ 
ing  accidents  and  incidents  were  caused  by  inappropriate  interaction  between  aircrew  and  auto¬ 
mation  (Winer  and  Nagel,  1988). 

The  aircraft  environment  differs  somewhat  from  the  satellite  controller  because 
the  pilot  is  within  the  vehicle.  However,  we  already  have  evidence  that  on-satellite  automation 
may  not  eliminate  the  need  for  operator  supervision.  Deep  Space  1  successfully  intercepted  an 
asteroid  while  under  the  guidance  of  its  automation.  Unfortunately,  the  vehicle  did  not  orient 
itself  so  that  the  asteroid  appeared  in  its  camera  field-of-view.  NASA  declared  the  rendezvous  a 
success,  but  the  failure  to  image  the  asteroid  smacked  of  failure  to  accomplish  the  imaging  mis¬ 
sion.  Ground  controller  supervision  of  the  intercept  could  have  detected  and  corrected  the  sensor 
orientation  problem  and  permitted  imaging  of  the  asteroid.  Just  as  lA  software  is  meant  to 
monitor  and  facilitate  human  performance,  operator  monitoring,  and  supervision  of  on-board 
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automation  can  prevent  the  automation  from  making  errors  that  jeopardize  the  spacecraft  or  its 
mission. 

5.1 .6.  Creation  and  Maintenance  of  an  Operator  Error  Data  Base 

This  data  base  would  be  modeled  after  the  Federal  Aviation  Administration’s 
(FAA’s)  reporting  system  for  pilots-- where  anonymous  reports  are  recorded  so  that  all  errors  are 
shared  in  the  flying  community.  Reports  of  space  operator  errors  would  be  collected,  analyzed, 
and  reported  to  the  user  community.  Differing  from  Aerospace  Corporation’s  anomaly  data 
whose  reports  are  made  only  when  system  degradations  or  losses  occur,  the  operator  error  data 
base  would  require  reporting  even  correctable  operator  errors.  Greater  error  reporting  without 
retribution  will  serve  the  operator  community,  promoting  awareness  of  problems  before  they  re¬ 
sult  in  system  degrade  or  loss.  The  error  data  base  would  serve  as  the  basis  for  both  initial  and 
recurring  training—benefiting  all  space  operators.  Such  a  data  base  would  need  to  be  strongly 
endorsed  by  United  States  Space  Command  (USSC)  and  AFSPC  so  that  operators  will  be  en¬ 
couraged  to  make  reports. 

Initial  development  of  a  human  error  data  base  would  be  done  to  support  the 
AFRL  space  research  program.  The  data  base  would  be  a  living  testimonial  to  AFRL/HE’s  con¬ 
cern  for  operational  effectiveness.  Long  term  maintenance  of  the  error  data  base  could  be  done 
by  AFRL  scientists  and  engineers,  or  by  AFRL’s  CSERIAC  support  contractor,  or  be  incorpo¬ 
rated  into  Aerospace  Corporation’s  anomaly  data  base  as  a  special  category,  or  transitioned  to 
Air  Force’s  safety  agencies. 

5.1.7.  Extension  and  Expansion  of  Display  and  Control  Guidelines 

Neither  AIAA’s  style  guide,  or  the  HMIWG’s  proposed  formats,  go  far  enough  to 
standardize  displays  and  controls  for  satellite  operations.  The  cognitive  engineering  initiative 
and  validation  of  the  hierarchy  of  abstraction  and  other  constructs  should  be  able  to  define  at 
least  high-level  display  formats  for  operators.  These  specifications  for  satellite  controls  could  be 
used  as  a  basis  for  a  military  standard  (unlikely  given  the  move  to  eliminate  or  dilute  military 
standards)  or  be  submitted  to  AIAA/ANSI  as  a  replacement  for  the  current  guidelines.  Wide¬ 
spread  use  of  standards  should  be  encouraged  by  requiring  conformity  on  new  DoD  satellite 
system  deliveries.  The  benefits  to  standardizing  displays  and  controls  would  be  in  smaller  op¬ 
erations  crew  sizes  and  lower  training  costs. 

5.2.  Common  Program  Support  Elements 

A  research  and  engineering  development  program  for  HE  satellite  control  needs 
several  support  elements  to  be  successful.  Planning  for  this  common  support  can  dramatically 
improve  the  program  quality  and  significantly  reduce  the  cost  of  execution.  The  proposed  sup¬ 
port  elements  include  working  relationships  with  the  Air  Force  logistics  and  operations  commu¬ 
nity,  development  of  a  modular  common  satellite  model,  and  a  capacity  to  support  classified  re¬ 
search. 
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5.2.1.  Collaborative  Partners  in  Space  Research 

Human  factors  engineering  research  into  unmanned  spaceflight  control  should  be 
conducted  in  collaboration  with  Air  Force,  other  Government  and  conunercial  interested  and 
willing  parties.  Starting  with  AP^RL,  an  obvious  collaborator  is  the  Space  Vehicles  Directorate 
(AFRITVS).  AFRiyvS  mission  is  to  discover,  develop,  integrate,  and  deliver  affordable  tech¬ 
nologies  for  improved  warfighting  capabilities.  The  research  effort  must  be  coordinated  with  VS 
efforts  to  prevent  overlap  and  create  synergy. 

There  are  two  organizations  at  Schriever  AFB,  which  can  serve  as  technology 
transition  partners  for  AFRL  space  human  factors  research.  The  first  organization  is  the  Space 
Battle  Lab.  The  Space  Battle  Lab  is  in  the  operations  chain-of-command,  a  part  of  SWC  of 
AFSPC.  Interaction  with  the  operational  chain-of-command  increases  the  relevance  of  the  re¬ 
search,  provides  access  to  the  space  controllers  for  design  information  and  testing,  and  provides 
support  for  continued  funding  of  research. 

The  second  organization,  which  should  participate  in  the  space  human  factors 
program,  is  the  CERES.  CERES  is  in  the  procurement  chain-of-command,  organized  under 
SMC  of  AFMC.  It  is  actively  involved  with  evaluating  COTS  satellite  control  systems  and  has 
existing  laboratory-type  resources  at  Schriever  AFB.  Close  cooperation  with  CERES  connects 
the  research  to  the  procurement  system,  offers  a  location  for  field  research  at  USSC,  and  has  re¬ 
sources  that  can  facilitate  the  start-up  of  the  AFRL  research  program. 

Other  Government  agencies,  which  should  be  collaborated  with,  include  NASA 
and  the  National  Research  Office  (NRO).  NASA  sites  can  include  Johnson  Spacecraft  Center 
who  is  sponsoring  Shalin’s  work.  Jet  Propulsion  Laboratory,  and  Goddard  Spaceflight  Center. 
NRO  is  responsible  for  classified  satellite  operations  and  might  also  benefit  from  efforts  to  in¬ 
crease  satellite  controller  effectiveness.  AFRL/HE  has  secure  facilities  that  are  suitable  for  clas¬ 
sified  research. 


Additionally,  an  effort  should  be  made  to  reach  the  other  service  laboratories,  to 
NASA,  and  to  the  commercial  satellite  industry  to  create  further  collaborations.  These  organiza¬ 
tions  operate  significant  numbers  of  space  systems  and  should  be  receptive  to  sharing  informa¬ 
tion  on  problems  and  to  take  advantage  of  AFRL  space-related  research. 

5.2.2.  A  Common  Modular  Satellite  Model 

The  AFRL  space  research  program  should  develop  a  COmmon  Modular  SAtellite 
Model  (COMSAM)  to  support  the  various  aspects  of  the  satellite  control  research  program.  This 
model  need  not  be  developed  from  scratch,  but  might  be  based  on  existing  models  in  the  training 
and  operations  communities  at  AFSPC,  NASA  spacecraft  models,  or  commercially  available 
model  software.  Strict  modularity  and  configuration  control  should  prevent  the  proliferation  of 
incompatibilities  among  model  users  and  permit  users  to  take  advantage  of  improvements  to  the 
model.  Certain  elements  of  the  model  may  be  different,  such  as  payload  or  propulsion  systems, 
but  these  differences  can  be  managed  without  adversely  affecting  the  common  features. 
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As  described  earlier,  another  feature  of  COMSAM  should  be  DIS/HLA  compati¬ 
bility.  A  DIS/HLA  communications  module  could  be  added  that  makes  both  satellite  position 
and  payload  products  available  to  other  simulations.  Data  could  be  collected  to  determine  how 
enhanced  displays  and  controls  improve  system  performance  in  as  high  a  fidelity  environment  as 
is  technically  possible.  Both  the  whole  model  and  the  communications  module  could  be  pro¬ 
gram  products,  which  can  be  used  by  AFSPC,  SMC,  and  others. 

5.2.3.  Shared  Space  Research  Facilitv 

Traditionally,  AFRL  researchers  have  built  separate  laboratories  to  conduct  their 
own  research  into  related  phenomenon.  This  approach  was  inefficient,  costly,  and  impractical 
given  the  current  budget  environment.  The  proposed  approach  follows  after  the  AFRL/HE’s 
Synthesized  Immersion  Research  Environment  (SIRE)  facility  where  one  laboratory  with  ex¬ 
traordinary  resources  is  shared  by  a  number  of  researchers.  The  Shared  Space  Research  Facility 
(SSRF)  could  host  the  several  researchers  who  will  conduct  their  studies  on  its  resources.  Fund¬ 
ing  for  maintaining  the  facility  would  come  directly  ftom  the  directorate,  with  individual  re¬ 
search  projects  separately  funded  to  make  modifications  necessary  for  individual  work  and  to 
conduct  their  data  collections.  The  SSRF  should  probably  be  located  in  Building  248  in  the 
TEMPEST  certified  vaults  BOS  or  B07  so  that  the  facility  can  conduct  classified  research  if  so 
desired. 


The  SSRF  would  host  one  or  more  satellite  models  and  could  be  used  to  simulate 
a  SOC,  the  higher  headquarters— ACKI!~or  both,  to  study  their  interaction.  Research  will  span 
individual  console  design  to  teaming  and  collaborative  studies.  With  models  capable  of 
DIS/HLA  participation,  the  vault  should  have  high-speed  network  access  with  special  considera¬ 
tion  for  seciuity  requirements  should  the  facility  go  classified. 
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6.  SUMMARY 


The  history  of  unmanned  spaceflight  operations  clearly  shows  the  impact  on  op¬ 
erations  when  human  engineering  is  overlooked  or  ignored;  the  effects  vary  from  disruption,  to 
degrade,  all  the  way  to  mission  loss.  The  SSED  data  base  indicates  this  has  been  a  persistent  and 
reoccuning  human  error  problem  in  sateUite  operations.  Recent  mission  losses  by  NASA  under¬ 
score  the  dire  consequences  of  ignoring  operator  error.  Unmanned  space  operations  need  assis¬ 
tance  from  human  engineering  research  to  address  display  and  control  deficiencies. 

Current  generation  satellite  controller  displays  and  controls,  though  workable,  do 
little  to  facilitate  operator  situation  awareness  and  prevent  human  error.  This  requires  larger  op¬ 
erations  crews  and  labor  intensive  cross  checks  for  quality  control—expensive  labor  is  being  used 
in  lieu  of  effective  control  systems.  Poor  display  and  control  design  combined  with  lack  of  stan¬ 
dardization  among  different  satellite  systems  places  an  enormous  burden  on  the  training  commu¬ 
nity  to  maintain  a  proficient  spacecraft  controller  force.  Continuing  budget  pressure  on  the  Air 
Force  will  quickly  make  trading  labor  for  adequate  display  and  control  technology  unacceptable. 

A  comprehensive  program  is  proposed  to  address  the  controller  interface  defi¬ 
ciencies.  The  proposal  includes  elements  with  immediate  benefits  to  the  satellite  control  com¬ 
munity  (operator  error  data  base,  modeling  and  HLA  simulation,  and  intelligent  aiding)  as  well 
as  fostering  leading  edge  research  to  achieve  longer-term  benefits  (cognitive  engineering,  real¬ 
time  control,  interaction  with  automation,  and  design  guidelines).  Additionally,  reconunenda- 
tions  are  made  about  methods,  modeling  approach,  and  sharing  resources  to  make  the  program 
cost-effective. 


The  Air  Force,  DoD,  NASA,  NRO,  and  commercial  satellite  operators  can  all 
benefit  from  the  proposed  research.  Collaboration  among  these  satellite  users  can  reduce  costs 
and  maximize  program  benefits. 
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7.  GLOSSARY  OF  TERMS  AND  ABBREVIATIONS 


AFMC 

AFRL 

AFSPC 

AI 

AIAA 

ANSI 

AMD 

AOC 

CERES 

COMSAM 

CSOC 

CSP 

DIS 

DMT 

DPS 

DSl 

ECP 

ERS 

ESR 

ESA 

EXEC 

FAA 

EOT 

FUSE 

GSFC 

GUI 

HCI 

HE 

HLA 

HMIWG 

HST 

lA 

ICD 

ISA 

ISC 

IMOC 

ISTP 

JPL 

MAS 

MCO 

MGS 

MIR 

MMS 

MO 


Air  Force  Materiel  Command 
Air  Force  Research  Laboratory 
Air  Force  Space  Command 
Artificial  Intelligence 

American  Institute  of  Aeronautics  and  Astronautics 

American  National  Standards  Institute 

Angular  Momentum  Desaturation 

Aerospace  Operations  Center 

Center  for  Research  Support 

Common  Modular  Satellite  Model 

Consolidated  Space  Operations  Center 

Contact  Support  Plan 

Distributed  Interactive  Simulation 

Distributed  Mission  Training 

Distributed  Problem  Solving 

Deep  Space  1 

Engineering  Change  Proposal 
Engineering  Research  Simulator 
Emergency  Sun  Reacquisition 
European  Space  Agency 
Executive 

Federal  Aviation  Administration 

Flight  Operations  Team 

Far  Ultraviolet  Spectroscopic  Explorer 

Goddard  Space  Flight  Center,  NASA 

Graphical  User  Interface 

Human-Computer  hiterface 

Human  Effectiveness  Directorate 

High-Level  Architecture 

Human-Machine  Interface  Working  Group 

Hubble  Space  Telescope 

Intelligent  Agent 

Interface  Control  Documents 

Initial  Sun  Acquisition 

Information  Systems  Center,  NASA/Goddard 

ISTP  Mission  Operations  Control  Center 

International  Solar  and  Terrestrial  Program 

Jet  Propulsion  Laboratory,  NASA 

Multi- Agent  System 

Mars  Climate  Observer 

Mars  Global  Surveyor 

Mode  Identification  and  Recovery 

Matra  Marconi  Space 

Mars  Observer 
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MOI  Mars  Orbital  Insertion 

MPL  Mars  Polar  Lander 

NASA  National  Aeronautics  and  Space  Administration 

NRO  National  Reconnaissance  Office 

PS  Planner/Scheduler 

RA  Remote  Agent 

SAC  Strategic  Air  Command 

SGASAA  Standard  Generic  Approach  to  Spacecraft  Autonomy  and  Automation 
SIRE  Synthesized  Immersion  Research  Environment 

SIS  Software  Interface  Specification 

SMC  Space  and  Missile  Systems  Center  (Air  Force  Materiel  Command) 

SOC  Space  Operations  Center 

SOPC  Science  Operations  and  Planning  Computer 

SOHO  Solar  Heliospheric  Observatory 

SSED  Space  Systems  Engineering  Data  Base 

SWC  Space  Warfare  Center 

TCM  Trajectory  Correction  Maneuver 

UAV  Unmanned  or  Uninhabited  Air  Vehicle 

USSC  United  States  Space  Command 
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